QUANTUM STEGANOGRAPHY AND QUANTUM ERROR-CORRECTION 

by 

Bilal A. Shaw 



A Dissertation Presented to the 
FACULTY OF THE USC GRADUATE SCHOOL 
UNIVERSITY OF SOUTHERN CALIFORNIA 
In Partial Fulfillment of the 
Requirements for the Degree 
DOCTOR OF PHILOSOPHY 
(COMPUTER SCIENCE) 



August 2010 



Copyright 2010 



Bilal A. Shaw 



To my parents 
Afzal and Yaqoot Shaw, 
and to my sister 
Husna Shaw. 



Acknowledgments 



There are many people in my life without whom I would not have been able to find my 
way to the United States of America, and then to the University of Southern California 
(USC), and without whom I would not be writing my doctoral dissertation. The path 
toward my doctoral thesis has been a long and arduous one. My intellectual adventure 
would not have been possible without the undying support, will, generosity, passion, 
intellectual curiosity, and tough-love of my advisor. Thank-you Todd for giving me a 
chance, and believing in me. 

Had I not picked up Surely you are joking Mr. Feynman as a young boy growing up 
in Kashmir, I probably would never have enjoyed physics, let alone quantum physics. 
Feynman's exploits, adventures, and passion for physics led me to pursue my doctorate. 
His legacy continues to inspire me to strive for excellence in science, while at the same 
time reminding me to not take life too seriously. Thank-you Dick! 

I first got a taste of quantum information science (QIS) when I attended Computing 
Beyond Silicon Summer School (CBSSS) at Caltech in the summer of 2002, which I later 
helped to organize in the summer of 2004. I had the pleasure of hearing John PreskilFs 
talk on quantum fault-tolerance, and Isaac Chuang's talk on quantum computing. At 
Caltech I met a brilliant young post-doctoral fellow by the name of Dave Bacon with 
whom I talked at length about quantum error-correction, and with whom I continued 
talking over the ensuing years. I thank Dave for being my mentor. I was fortunate that 
USC decided to delve into QIS by hiring Todd. I was searching for Ph.D. advisors at 



iii 



the time, and having talked to Dave, I knew that Todd would be a perfect fit for me. I 
am happy and fortunate in knowing that this came out to be true in the end. 

I thank Leonard Adleman who was my advisor during my undergraduate and Masters 
years at USC. He taught me the importance of mathematical rigor and maturity, doing 
good scientific research, and the art of giving an excellent talk. With him I learned 
first-hand that we live in an increasingly multi-disciplinary world. It is not enough to be 
just a mathematician, or just a biologist, or a physicist. The new world demands young 
graduates to move seamlessly and effortlessly between various fields. It demands us to 
be both a frog and an eagle; to be able to wallow in the mud at the edges of a pond, and 
dive into its depth without fear, and at the same time to be able to soar like an eagle 
above mountain-tops, with courage. He taught me not to be afraid to work on "cool" 
ideas. I also thank Nickolas Chelyapov who during this time taught me many molecular 
biology techniques and the discipline required of a good scientist. I thank one of my best 
friends Paul Rothemund who gave me his full support while I was Len's student. 

I thank Daniel Lidar who taught me quantum error-correction (QEC) and the theory 
of open quantum systems at USC. The first paper that I wrote was a direct result of a 
project he gave his students to complete in his QEC course. Later when I gave a talk 
based on this project at the American Physical Society's March meeting in 2008 in New 
Orleans, I won the best student presentation award. I am deeply grateful to Daniel for 
being an excellent educator and scientist. 

I thank Igor Devetak whom I met in 2005, and who later taught me quantum Shan- 
non theory. I thank him for his friendship and for the various discussions he and I 
had on information theory which helped shape my own intellectual landscape. I also 
thank him for being part of Todd's research group meetings where I was among the 
first students to witness the birth of entanglement-assisted quantum codes. This cod- 
ing scheme ultimately allowed researchers to import all of classical coding theory into 
quantum information science. 



iv 



I thank my friend, collaborator, and colleague Mark Wilde. His passion for this 
field helped kindle my own when I felt as if the fire within me was starting to die. His 
brilliance and ambition has been a source of inspiration to me. I would also like to 
thank him while I was in New Orleans attending the American Physical Society's March 
meeting, for his parents opened the doors of their heart and their home to me. 

I thank Min-Hsiu Hsieh, Hari Krovi, Jose Gonzalez, Stephen Jordan, Zhicheng Luo, 
Ognyan Oreshkov, Shesha Raghunathan, and Martin Varbanov with whom I have had 
various discussions on quantum information science in particular, and life in general. 
Ognyan was a big help to me in completing my project on quantum error-correction. I 
had an excellent time working on one of Igor Devetak's class projects with Hari. 

I owe many thanks to Gerrielyn Ramos, Milly Montenegro, Anita Fung, Tim Boston, 
Lizsl DeLeon, Steve Schrader, and Jun Camacho who did an excellent job in taking care 
of my paperwork and making sure that I was on top of non-research related things. I 
would not have been able to complete my research at USC without the support that 
I received from the computer science department at USC. The teaching assistantships 
helped me to survive in an overly expensive city. I thank Michael Crowley and David 
Wilczynski for taking me on as their teaching assistant. 

I would like to thank the folks outside my USC circle who supported me with their 
kind words, thoughts, prayers and blessings. At face value the Ph.D. is an original piece 
of research, but to me it has been more than mere tinkering with ideas, writing papers 
and giving talks. To me it has signified my intellectual, spiritual, and emotional growth 
as a human being and as a scientist. I am indebted to my yoga instructors Travis Eliot 
and Jennifer Pastiloff for introducing me to yoga. This has been my salvation when 
I needed to unhook and unplug from the vibe of Los Angeles and USC. I am deeply 
thankful to Los Angeles that nurtured my pursuits outside of academia. I have basked 
in her beautiful sunshine, enjoyed walks on her beaches and hiked in her mountains. I 
thank all the talented baristas at Peet's Coffee and Tea in Brentwood who provided me 
with free coffee while I was doing research. 

v 



Lastly I thank my friends Iftikhar Burhanuddin, Tony Barnstone, Matthew Harmon, 
and Jonathan Trachtman. Matt and J. T. expanded my musical horizons and allowed 
me to explore musical genres that helped me during the many hours I spent writing 
my thesis and my papers. My escape from science has been writing poetry and to that 
I owe much thanks to Tony. I thank Ifti for all the interesting conversations we had 
on algorithms. I also thank my uncle Bashir Shaw and my aunt Khursheed Shaw who 
provided a roof over my head for three years when I was an undergraduate at Whittier 
College. I thank all of my teachers in Burn Hall High School, Kashmir, Saint Columba's 
High School, New Delhi, and Whittier College, California. 

In the end none of this would have been possible without the unconditional and 
unwavering love of my father Afzal, my mother Yaqoot, my sister Husna, and the memory 
of my days as a child growing up in Kashmir. 



vi 



Table of Contents 

Dedication [n] 

Acknowledgments [m] 

List of Tables [Ix] 

List of Figures |xi] 

Abstract Ixivl 

Chapter 1: Introduction [1] 

1.1 A Brief History of Quantum Information Science Q] 

1.2 Thesis Organization [7J 

Chapter 2: Quantum Stabilizer Codes [9] 

2.1 The Stabilizer Formalism [10] 

2.2 Quantum Error-Correction [J3] 

2.3 Encoding Unitary [16] 

2.4 Concluding Remarks [TH] 

Chapter 3: The Six-Qubit Code Ql 

3.1 Introduction [19] 

3.2 Degenerate Six-Qubit Quantum Code [22] 

3.2.1 Subsystem Code Construction [25] 

3.3 Non-existence of a [[6, 1, 3]] CSS Code [27] 

3.4 Non-degenerate Six-Qubit CSS Entanglement- Assisted Quantum Code . . [31] 

3.5 Non-existence of [[n, 1, 3; 1]] CSS codes for n < 5 [39] 

3.6 Entanglement-Assisted Encoding Circuit 

3.7 Concluding Remarks [51] 

Chapter 4: Classical Steganography [53] 

4.1 Introduction [53] 

4.2 Syndrome Encoding [57] 

4.2.1 Noisy Bit-Flip Channel [63] 

4.2.2 Numerical Simulation [68] 

vii 



4.3 Inner-Outer Codes [78] 

4.3.1 Classical Steganographic Protocol [79] 

4.3.2 Three Bits In N Bits Encoding EH 

4.3.3 M Bits In N Bits Encoding [8j 

4.3.4 Key Consumption Rate [85] 

4.4 Concluding Remarks [551 

Chapter 5: Quantum Steganography [93] 

5.1 The Depolarizing Channel [95] 

5.2 The Diamond Norm 11021 

5.3 Concluding Remarks 11121 

Chapter 6: Hiding Quantum Information in the Perfect Code 11141 

6.1 Protocol [TT51 

6.2 Average rate of steganographic transmission 11271 

6.3 Key Consumption 11291 

Chapter 7: Conclusion and Future Directions 11341 
Bibliography H37I 



viii 



List of Tables 



2.1 Hadamard transformation of the Pauli matrices [16] 

2.2 Phase transformation of the Pauli matrices [16] 

2.3 CNOT transformation of two qubits [T7J 

3.1 Stabilizer generators hi, ■ ■ . , h$, and logical operators X and Z for the 
six-qubit code. The convention in the above generators is that Y = ZX. . [23] 

3.2 Stabilizer generators hi, h%, h% and /15, gauge subgroup generators Hx and 
Hz, and logical operators X and Z for the six-qubit code. The convention 

in the above generators is that Y = ZX [27] 



3.3 (a) The generators and logical operators for the unencoded state. Gen- 
erators (73 and g'§ indicate that Alice and Bob share an ebit. Alice's half 
of the ebit is her first qubit and Bob's qubit is the other half of the ebit. 
Generators g[, g' 2 , <? 4 , and g' 5 indicate that Alice's second, third, fourth, 
and fifth respective qubits are ancilla qubits in the state |0). The unen- 
coded logical operators X' and Z' act on the sixth qubit and indicate 
that the sixth qubit is the information qubit. (b) The encoded generators 
and logical operators for the [[6,1,3;!]] entanglement-assisted quantum 



error-correcting code [3H 

3.4 Distinct pairs of single-qubit Pauli errors for the [[6, 1,3]] quantum code. 
Each double-lined column lists a pair of single-qubit errors and a corre- 
sponding anticommuting generator (AG) for the code. X4 and Z^Zq lie 
in the gauge subgroup H [51] 

4.1 The first column represents message classical/quantum that we intend to 
hide. The second column represents the shared secret key between Alice 
and Bob. The third column represents the quantum error-correcting code. 
Here CQECC stands for Classically-Enhanced Quantum Error-Correcting 
Code; QECC stands for Quantum Error-Correcting Code and EAQECC 
stands for Entanglement-Assisted Quantum Error-Correcting Code .... [56] 

4.2 Channel model for the [3,1,3] repetition code [59] 

4.3 Conditional Probabilities - [3,1,3] Repetition Code EH1 

4.4 Channel model for the [5,1,5] code [73] 

4.5 N s is the number of steganographic bits that Alice can hide and subse- 
quently transmit to Bob. Column 2 shows the various encoding schemes 

that Alice can employ to successfully transmit steganographic bits to Bob. [75] 



ix 



4.6 The first column shows the two bits that Alice transmits to Bob, whereas 
the second column shows the received bits by Bob, some of which have 
experienced an error due to the noisy bit-flip channel [78] 

4.7 Encoding for transmitting one steganographic bit over a bit-flip channel 
with [3, 1,3] as an inner-code and [N, 1,N] as the outer code [81] 

6.1 Stabilizer generators g\, . . . , and logical operators X and Z for the 
perfect code. The convention in the above generators is that Y = ZX. . . 11161 

6.2 Syndrome table of the perfect code. The error operators are ordered 
according to syndrome values 11211 

6.3 Encoded error operators of the perfect code 11251 

6.4 Table of double-qubit errors. The error operators in bold represent a 
single encoding. The table represents a total of six different encodings 
where each encoding utilizes sixteen distinct error operators and their 
corresponding distinct syndromes (continued) 11321 

6.5 Table of double-qubit errors. The error operators in bold represent a 
single encoding. The table represents a total of six different encodings 
where each encoding utilizes sixteen distinct error operators and their 
corresponding distinct syndromes 11331 



x 



List of Figures 



2.1 Steps in quantum error-correction. Thin lines denote quantum informa- 
tion and thick lines denote classical information. Slanted bars denote 
multiple qubits. Alice the sender of quantum information encodes a multi- 
qubit state using ancilla qubits |0). She sends the encoded state over 
a noisy quantum channel. Bob on receiving the quantum information per- 
forms multi-qubit measurements to extract classical information about the 
errors. He finally performs a recovery operation R to reverse the channel 
error. This recovery operation is composed of firstly correcting the errors 
and secondly decoding the corrected state 

2.2 Alice encodes her one qubit of quantum information with the help of two 
ancilla qubits using the encoding unitary shown in the dashed red box in 
the left side of the figure. She sends the codeword to Bob who uses the 
error-diagnosis circuit shown in the dashed blue box. The result of this 
measurement is projected on to the two ancilla qubits at the bottom. The 
information from these ancillas (syndrome result) is then used to apply 
the recovery procedure. Bob can now finally decode the quantum state to 
obtain the original one qubit of quantum information 

3.1 Encoding circuit for the first six-qubit code. The H gate is a Hadamard 
gate. For example, we apply a Hadamard on qubit four followed by a 
CNOT with qubit four as the control qubit and qubit six as the target 
qubit 

3.2 Logical CNOT for the six-qubit quantum code. The first six qubits repre- 
sent a logical source qubit and the last six represent a logical target qubit. 
For example we begin the circuit by applying a CZ (controlled-Z) gate 
from source qubit two to target qubit seven 

3.3 Encoding circuit for the [[6,1,3;1]] code. The "H" gate is a Hadamard gate. 

4.1 There are three different inputs to the steganographic encoder £ : a cover- 
message \C); the secret message that we would like to hide, which can be 
quantum \S) or classical S; a shared secret key which may be quantum 
(ebit) \1C) or classical /C. Eve can monitor some part of the noisy quantum 
channel N shown in the red box. Bob can decode the steganographic 
message using the decoder T> and the shared secret key |/C) or /C and 
recover |C), and \S) or S with very high probability 

4.2 Average Number of Steganographic Bits vs. Error-Rate p 



4.3 Noiseless Three-Bit Code. We plot the error-rate on the X-axis and the 
average number of bits, N avg , on the Y-axis for various error sequences. 
Here k varies from 1 to 100. As the error-rate increases Alice can hide up 
to two bits. The red curve plots the Shannon entropy of the probability 
distribution of the syndromes [70] 

4.4 Noiseless Five-Bit Code. We plot the error-rate on the X-axis and the 
average number of bits, N avg , on the Y-axis for various error sequences. 
Here k varies from 1 to 100. As the error-rate increases Alice can hide up 
to six bits. The red curve plots the Shannon entropy of the probability 
distribution of the syndromes [76] 

4.5 Noisy Three-Bit Code. We plot the channel noise 5p on the X-axis and 
the average number of bits correctly received by Bob, N avg , on the Y-axis 

for various error-rates p which decrease by an order of magnitude [77] 

4.6 Classical Steganographic Protocol. The protocol begins in the top half. 
Alice's steganographic bits are shown in red. The one-time pad is shown 
in as green discs. The bold dashed line shows that Alice and Bob are 
separated over space and Alice uses a BSC to transmit the codeword to 
Bob. The bits colored red comprise the inner [3,1,3] block code, and the 
blue discs comprise the [10,1,10] outer block code. The noisy channel 
flips the fourth and eighth bits. The shared key is used by Alice and 
Bob to specify the location of the steganographic bits and to generate the 



one-time pad [89] 

4.7 Three Bits in N Bits Encoding. We plot the channel error-rate p on the 
X-axis and the average number of transmitted steganographic bits , N avg , 
on the Y-axis. Here M refers to the length of the inner code while N 
refers to the length of the entire block code. The curves in black show the 
Shannon entropy of the channel with the corresponding block code [90] 

4.8 M Bits in N Bits Encoding. We plot the channel error-rate p on the 
X-axis and the average number of transmitted steganographic bits , N avg , 
on the Y-axis. Here M refers to the length of the inner code while N 
refers to the length of the entire block code. The black curve shows the 
Shannon entropy of the channel when N = 17 bits [91] 

4.9 Key Consumption Rate. We plot the channel error-rate p on the X- 
axis and the key consumption rate KCR on the Y-axis. Here 5p = 
0.001, 0.005, 0.01, 0.05, and 0.1 M 

5.1 We plot the key consumption rate (KCR) as a function of the error-rate 

p of the channel [97] 



xii 



5.2 Quantum Steganographic Protocol. Alice hides her information qubit 
(solid brown circle) by swapping it in with a qubit of her quantum code- 
word. She uses her shared secret key with Bob to determine which qubit 
to swap. She uses the shared key again to twirl the information qubit. 
She further applies random depolarizing errors to the rest of the qubits 
of the codeword (shown in green). She sends the codeword through a 
depolarizing channel to Bob who uses the shared secret to correctly apply 
the untwirling operation, followed by locating and swapping out Alice's 
original information qubit 

6.1 Encoding circuit for the perfect code. The H gate is a Hadamard gate, 
and the two-qubit gates are CNOT gates. The first four qubits are ancilla 
qubits and the fifth qubit \ip c ) is the cover-qubit 

6.2 Steganographic protocol to hide four qubits of information using the per- 
fect code. Based on a classical shared secret key with Bob, Alice hides 
four qubits, ■ ■ ■ , IV^} by applying the twirling procedure to each of 
her four qubits and transforms each qubit into a maximally mixed state. 
We call this system the stego subsystem S. The twirling procedure is 
applied by the yellow box. We label the first four ancilla qubits |0) along 
with the cover-qubit \vpc) as Alice's subsystem A. The first unitary IA\ 
depicted by the blue box is applied to the subsystems A and S, followed 
by unitary U2. Finally Alice applies the encoding unitary £ to subsystem 
A and sends it over a channel to Bob. She traces out subsystem S. Bob 
upon receiving the codeword decodes it by applying the decoding circuit 
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Quantum error-correcting codes have been the cornerstone of research in quantum infor- 
mation science (QIS) for more than a decade. Without their conception, quantum com- 
puters would be a footnote in the history of science. When researchers embraced the 
idea that we live in a world where the effects of a noisy environment cannot completely 
be stripped away from the operations of a quantum computer, the natural way forward 
was to think about importing classical coding theory into the quantum arena to give 
birth to quantum error-correcting codes which could help in mitigating the debilitating 
effects of decoherence on quantum data. We first talk about the six-qubit quantum 
error-correcting code and show its connections to entanglement-assisted error-correcting 
coding theory and then to subsystem codes. This code bridges the gap between the 
five-qubit (perfect) and Steane codes. We discuss two methods to encode one qubit into 
six physical qubits. Each of the two examples corrects an arbitrary single-qubit error. 
The first example is a degenerate six-qubit quantum error-correcting code. We explicitly 
provide the stabilizer generators, encoding circuits, codewords, logical Pauli operators, 
and logical CNOT operator for this code. We also show how to convert this code into 
a non-trivial subsystem code that saturates the subsystem Singleton bound. We then 
prove that a six-qubit code without entanglement assistance cannot simultaneously pos- 
sess a Calderbank-Shor-Steane (CSS) stabilizer and correct an arbitrary single-qubit 
error. A corollary of this result is that the Steane seven-qubit code is the smallest single- 
error correcting CSS code. Our second example is the construction of a non-degenerate 
six-qubit CSS entanglement-assisted code. This code uses one bit of entanglement (an 

xiv 



ebit) shared between the sender (Alice) and the receiver (Bob) and corrects an arbitrary 
single-qubit error. The code we obtain is globally equivalent to the Steane seven-qubit 
code and thus corrects an arbitrary error on the receiver's half of the ebit as well. We 
prove that this code is the smallest code with a CSS structure that uses only one ebit and 
corrects an arbitrary single-qubit error on the sender's side. We discuss the advantages 
and disadvantages for each of the two codes. 

In the second half of this thesis we explore the yet uncharted and relatively undis- 
covered area of quantum steganography. Steganography is the process of hiding secret 
information by embedding it in an "innocent" message. We present protocols for hiding 
quantum information in a codeword of a quantum error-correcting code passing through 
a channel. Using either a shared classical secret key or shared entanglement Alice dis- 
guises her information as errors in the channel. Bob can retrieve the hidden information, 
but an eavesdropper (Eve) with the power to monitor the channel, but without the secret 
key, cannot distinguish the message from channel noise. We analyze how difficult it is 
for Eve to detect the presence of secret messages, and estimate rates of steganographic 
communication and secret key consumption for certain protocols. We also provide an 
example of how Alice hides quantum information in the perfect code when the underly- 
ing channel between Bob and her is the depolarizing channel. Using this scheme Alice 
can hide up to four stego-qubits. 
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Chapter 1 



Introduction 

When I heard the learn'd astronomer; 
When the proofs, the figures, were ranged in columns before me; 
When I was shown the charts and the diagrams, to add, divide, and 

measure them; 

When I, sitting, heard the astronomer, where he lectured with much 

applause in the lecture-room, 
How soon, unaccountable, I became tired and sick; 
Till rising and gliding out, I wander 'd off by myself, 
In the mystical moist night-air, and from time to time, 
Look'd up in perfect silence at the stars. 

— Walt Whitman 



1.1 A Brief History of Quantum Information Science 

_/\_Lthough I am not sure what exactly was going through James Clerk Maxwell's 
(1831 — 1879) mind when he formulated his now famous laws of electromagnetism, I 
can certainly imagine that he had no idea that a few decades into the future Thomas 
Alva Edison residing in the New World would construct several devices operating on the 
physics that he [Maxwell] worked to unify, namely electricity and magnetism. Moreover, 
he probably had no idea that in the future universities would award doctoral degrees in 
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electrical engineering, and that there would be entire departments dedicated to under- 
standing and engineering this force of Nature. Maxwell's work on electromagnetism has 
often been dubbed as the "second great unification in physics" second only to Sir Isaac 
Newton's first unification. 

Around the time that Edison was designing electrical machines in his copious note- 
books and subsequently inventing them, the world of physics was undergoing a revolution 
of its own. This revolution started when physicists observed phenomena (paradoxes) in 
Nature that could not be explained through classical physics. These included black-body 
radiation, the photoelectric effect, the stability of atoms (ultraviolet catastrophe), and 
matter waves (particle- wave duality). Through the efforts of brilliant scientists such as 
Einstein, Bohr, Schrodinger, Heisenberg, Pauli, Born and still others, these paradoxes 
were ultimately resolved. Their efforts led to the creation of the new field of quantum 
mechanics, when finally researchers realized that the sub-atomic world is intrinsically 
probabilistic, and that there is an underlying uncertainty in simultaneously measuring 
certain real-world observables such as the momentum and position of a particle. While 
the physicists were thinking about the atomic world, Claude Shannon ushered the field 
of information theory with his seminal paper of 1948 in which he established the source 
coding and channel coding theorems [33] • The former gives us the ultimate limit on the 
compressibility of information while the latter tells us that given a noisy channel, one can 
encode information in such a way that the receiver of information can reliably decode 
it. Of course this assumes that the designer of error-correcting codes has certain knowl- 
edge of the noise in the channel. Without Shannon's seminal work we would not have 
the modern communication devices that have become so ubiquitous, and which we take 
for-granted every day. While Claude Shannon was busy at Bell Labs solidifying his ideas 
on information theory and mathematical logic, Alan Turing was laying the foundation 
of modern computing theory. Turing wanted to know if there was a universal machine 
that could compute solutions to computable functions. All modern day computers from 
laptops to supercomputers are based on the simple notion that given a machine with 
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enough memory, a finite set of symbols and a read/ write head that can store its own 
state, one can perform complex computations. Alan Turing's simple yet deep insight is 
a testament to the power of great ideas and their ability to transform society (for the 
better) [52] . 

In science, unification occurs when ideas in its various fields have had enough time 
to mature. Several researchers before Maxwell had separately worked on electricity and 
magnetism before he unified these two pictures into the electromagnetic wave. Among 
these researchers the notable ones were Andre-Marie Ampere, Benjamin Franklin, J. J. 
Thompson, Oliver Heaviside, Joseph Henry, Nikola Tesla, and still others. Similarly, it 
took a few decades for quantum physics, information theory, and computer science to 
mature before these seemingly separate fields could be united into quantum information 
science. 

The story of this unification started when Richard Feynman and others asked the 
question of whether a computer operating on the laws of quantum physics might give an 
appreciable speed-up in simulating quantum physics problems that may be hard to solve 
on a classical computer \20\ [31 [3l] . This question was answered by Seth Lloyd in |33| . In 
the 1970s Charles Bennett (IBM) showed that any computation can in principle be done 
reversibly, based on earlier work by Rolf Landauer in the 1960s |31} 0]. Rolf Launder 
showed that if a computer erases a single bit of information, the amount of energy 
dissipated into the environment is at least ksT 'In 2, where fee is Boltzmann's constant 
and T is the temperature of the environment of the computer |38j . If a computation can 
be performed reversibly then no information is erased and hence there is no dissipation 
of energy. To realize the theory of quantum computation it was crucial to make this 
connection between reversibility and energy dissipation. This was because we evolve 
closed quantum system via unitary operators which are themselves reversible. 

One of the hallmarks of quantum mechanics is that one can write superpositions 
of various quantum states. One can then imagine exploiting these states in a parallel 
fashion via operators that transform these states. Researchers quickly realized that naive 
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applications of quantum parallelism added nothing to the power of the computer. But 
in 1985, David Deutsch found a clever algorithm that exploited quantum parallelism 
indirectly to solve a problem more efficiently than any possible classical computer |16j . 
The problem was artificial, but it was the first example where a quantum computer was 
shown to be more powerful than a classical computer. Richard Jozsa and David Deustch 
later generalized this problem and they showed that there was an exponential gap in 
query complexity between a quantum and a classical computer. We were starting to see 
a grand unification of quantum mechanics with computer science. 

Meanwhile in 1984 Charles Bennett and Gilles Brassard found a clever way to exploit 
the properties of quantum mechanics for information processing [5]. They were able to 
exploit the uncertainty principle as a way to distribute a cryptographic key to two parties, 
Alice and Bob, with perfect security. In their set-up single quanta were used to send bits 
of the cryptographic key in one of two possible complementary variables. If Eve tried to 
intercept the quantum bits and measure them, this would automatically disturb them in 
such a way that it could always be detected by Alice and Bob. Upon learning this, they 
would abort the protocol as it had been compromised. This scheme was aptly termed 
as the BB84 (Bennett-Brassard) protocol for quantum key distribution. We often hear 
people refer to the latter as quantum cryptography. We must make it clear that this 
is a misnomer. All that this protocol does is distribute keys securely to two parties. 
Alice and Bob can subsequently use their shared keys to send cryptographic messages to 
each other. We should also mention that this is the only quantum information protocol 
which has been realized commercially. Charles Bennett and his collaborators found 
even more interesting quantum communication protocols. In particular they found one 
where a sender could send an unknown quantum state to a receiver using a classical 
channel and consuming shared entanglement between the sender and the receiver. We 
call this quantum communication protocol as quantum teleportation [7]. Bennett along 
with Stephen Weisner engineered a protocol by which a sender could transmit classical 
information by consuming shared entanglement and utilizing a quantum channel between 
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the sender and the receiver [6] . We call this quantum communication protocol as super- 
dense coding. 

Even before Charles Bennett and company started exploiting the power of quantum 
physics to perform information theoretical tasks, Stephen Wiesner had indicated in a 
paper Conjugate Coding that it was impossible to perfectly duplicate or clone two or 
more unknown nonorthogonal quantum states. This paper which was submitted to IEEE 
Transactions on Information Theory in 1970 was summarily rejected as it was written in 
a language incomprehensible to computer scientists, information theorists, and electrical 
engineers. His work was finally published in its original form in [54] in 1983 in Association 
of Computing Machinery, Special Interest Group in Algorithms and Computation Theory. 
In the same paper Wiesner also suggested that his no-cloning theorem could also enable 
the possibility of money whose authenticity would be guaranteed by the laws of quantum 
physics. The no-cloning theorem places a severe constraint on what can be achieved 
by uniting ideas from quantum mechanics and information theory. This was one of 
the earliest concerns raised by researchers on the viability of an operational quantum 
computer. 

There was an uneasiness in the research community that perhaps a quantum com- 
puter would only be good for solving toy problems and, moreover, clever randomized 
algorithms could probably beat these toy quantum algorithms. In addition because 
of the sensitive nature of quantum systems and their susceptibility to noisy environ- 
ments researchers believed that any quantum state that one would prepare as input to 
a quantum computer would rapidly decohere because of unwanted interactions with its 
environment. Another major objection to a viable quantum computer was the quantum 
mechanical principle that measurement destroys a quantum state. As we shall see in sub- 
sequent chapters that despite these objections researchers were able to forge ahead and 
develop quantum error-correcting codes that reduced the negative effects of decoherence 
and got around the measurement problem. 
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In 1994 Daniel Simon discovered a quantum algorithm for another toy problem that 
provided an exponential separation in query complexity over a classical randomized 
algorithm [48j. The stage was being set for a major breakthrough. In the same year a 
mathematician by the name of Peter Shor at AT&T Bell Labs discovered two polynomial 
time quantum algorithms |45| 146] . The first algorithm could factor integers in polyno- 
mial time, whereas the second algorithm gave an exponential speed-up over the discrete 
logarithm problem. Both factoring and the discrete logarithm problems are extremely 
hard problems. The reason why Shor's algorithm turned several heads was because 
firstly it became apparent that quantum algorithms were good at something other than 
solving mere toy problems, and secondly the security of well known cryptosystems such 
as RSA [JT] relies on the hardness of factoring while the security of ElGamal cryp- 
tosystem [18J relies on the hardness of the discrete logarithm problem. Researchers in 
cryptography have been working on post-quantum cryptography. In the event when 
large-scale quantum computers become operational, which public-key schemes would be 
resistant to quantum computer attacks? 

The explosion in the number of papers being published in quantum information sci- 
ence is extraordinary. In just a few years the field has matured to the point where it is 
no longer possible for a single researcher to keep track of all the papers being published. 
In the theoretical arena alone researchers are working on quantum error-correcting 
codes, fault-tolerant quantum computing, quantum algorithms, quantum Shannon the- 
ory, quantum entanglement, quantum complexity theory, and open quantum systems. 
There is of course a parallel effort to realize various quantum computing and quan- 
tum Shannon schemes experimentally through solid-state physics, nanophotonics, and 
Bose-Einstein condensates. 

So perhaps in the near future when quantum information science comes of age, the 
term "quantum computer" will be a household name, just as PCs or MACs are today. 
Perhaps in the future QIS will not be a loose conglomerate of such academic depart- 
ments as electrical engineering, computer science, physics, and mathematics, but will be 
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a department in its own right. Maybe we will routinely hear quantum states being tele- 
ported over quantum networks, or high school students running quantum simulations on 
their personal quantum computers, or big business deals being carried out using quan- 
tum cryptography and quantum steganography. Perhaps then the efforts and passion of 
all the hardworking researchers in this field will be truly realized on a societal level; a 
triumph. 

1.2 Thesis Organization 

This thesis is a major contribution to quantum error-correction theory and quantum 
Shannon theory. This thesis is essentially divided into two parts. In the first half we 
present the theory of quantum error-correction starting with quantum stabilizer codes 
in the next chapter. The six-qubit code bridges the gap between the five-qubit (perfect 
code) and the Steane codes. The five-qubit has been extensively studied in [38] because it 
was the first example of the smallest non-degenerate code that could correct an arbitrary 
single-qubit error [30j. The seven-qubit code, popularly known as the Steane code after 
its discoverer Andrew Steane, has also been studied extensively because it lends itself 
nicely to a fault-tolerant design of universal quantum gates [50] . In fact if we open |38j 
we find that the authors provide a detailed study of these two codes, but none for the six- 
qubit code. We hope that when quantum computers become operational, the six-qubit 
code will provide a middle ground for encoding quantum data. 

In the second half of this thesis we present the theory of quantum steganography. It 
came as a surprise to us that this sub-area of quantum Shannon theory had barely been 
explored given that classical steganography has been around since Simmons first posed 
the problem in 1983 using information-theoretic terminology [49J. In order to develop 
quantum steganography we needed to develop intuition about classical steganography 
using classical error-correcting codes. In Chapter [4] we present classical ideas on infor- 
mation hiding. After we develop our intuition for classical steganography we present our 
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full formalism for quantum steganography in Chapter [5] We provide the rate of stegano- 
graphic information and give specific examples of how to hide qubits using quantum 
error-correcting codes transmitted over the binary-symmetric and depolarizing channels. 
In Chapter [6] we show how one can use the second protocol detailed in Chapter [5] to hide 
up to four stego-qubits in the perfect code. For a specific encoding we give the optimal 
number of stego-qubits that Alice can send to Bob over the depolarizing channel as a 
function of the error-rate. In the same chapter we also show the amount of key consumed 
by Alice and Bob to realize this protocol. We hope that this work will blossom into a 
sub- field of quantum information science just as quantum cryptography has in recent 
years. 

The mathematics behind these ideas is simple and straightforward, and all that one 
requires to fully comprehend this thesis is mathematical maturity, knowledge of college 
level linear algebra, and familiarity with Dirac notation used in quantum mechanics. We 
end the thesis with closing remarks in which we outline some further work that one can 
pursue in quantum steganography. 
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Chapter 2 



Quantum Stabilizer Codes 

It is not knowledge, but the act of learning, 
not possession but the act of getting there, 
which grants the greatest enjoyment. 

— Carl Friedrich Gauss 

' J^He stabilizer formalism is to quantum error-correction what additive codes are to clas- 
sical linear error-correction. It is a powerful mathematical framework based on group 
theory. Using this formalism a quantum-code engineer can import classical codes using 
the CSS construction (dual-containing codes) [501 EH]) and design quantum codes 
with good error-correcting properties and good rates. More recently the stabilizer for- 
malism has been used to design graph states [24J. It is used in cluster-state quantum 
computation [40j, and the theory of entanglement [19]. It has also been extended to 
entanglement-assisted quantum codes Much of the stabilizer formalism was worked 
out be Daniel Gottesman in his brilliant thesis |22j . For more details we direct the reader 
to his thesis. 

In this chapter we review the stabilizer formalism for block-codes, the steps involved 
in error-correction, the Clifford operations that one uses to construct the encoding uni- 
tary circuits for these codes. We assume the reader is familiar with elementary group 
theory at the undergraduate college level [32]. In this chapter we have used Mark Wilde's 
thesis for some of the exposition [35] . 
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2.1 The Stabilizer Formalism 



One of the hallmarks of the stabilizer formalism is that it gives us a compact represen- 
tation of a quantum error-correcting code. Instead of keeping track of the amplitudes of 
complicated superpositions of quantum codewords, we can just keep track of the stabi- 
lizer generators of the code (which are linear in the number of qubits) . As an example 
consider the following GHZ state: 

The following operators leave the GHZ state unchanged: 

hhh = I® I ®I, 

Z X Z 2 = Z®Z®I, 

ZiZ 3 = Z®I®Z, 

Z 2 Z 3 = I®Z®Z, 

XiX 2 X 3 = x®x®x. 



We say that the GHZ state is fixed or stabilized by the operators above. The main 
idea in the stabilizer formalism is that one can just think of these operators and their 
transformation as they are acted upon by error operators, encoding unitary operators, 
and measurement operators. The stabilizer is a subgroup of the general Pauli group G n 
on n qubits. More specifically G n is an n-fold tensor product of the matrices from the 
Pauli set P = {I,X,Y,Z}: 



I = 


1 





, x = 





1 
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, Z^ 
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We write the set G n as: 

G n = {e i *Ai®---®A n :Vj€{l,...,n}, Aj G P, G {0, vr/2, tt, 3^/2}} . (2.2) 

An example of an element from G n is X\ = X <g) / <g> . . . <g> I, where X acts on the 
first qubit, while the n — 1 identity operators act on rest of the n — 1 qubits. While 
writing these n-fold tensor operators we will often omit the tensor product sign, and 
just indicate the operator as X\ or as XI . . . I. We need the factors ±1, ±i in front of 
the group elements so that the group is closed under multiplication. Three interesting 
properties of the elements of G„ are that they either commute or anticommute with each 
other, each has eigenvalue +1 or -1, and the product of each element with itself is the 
n-fold identity operator. The stabilizer is a subgroup § n of G n such that all the elements 
in it commute with each other. Each element of S n stabilizes some number of quantum 
states. The intersection of all these subspaces fixed by each element of S n constitutes 
the codespace. In group theory one can reconstitute the entire group by the underlying 
group operation between some specific elements of the group called generators. So this 
way we get a very compact representation of the group. Instead of listing all the elements 
of the group, we just specify its generators. As an example, consider the the group G3 
whose members 3-fold tensor product of Pauli operators and whose members operate on 
three qubits. This group has 4 3 *4 = 256 members. We enumerate some of the members 
of this group below: 

G 3 = {±111, ±UII, ±XII, ±iXII, ±ZZZ, ±iZZZ} . 

Let §3 = {III, ZZI, IZZ, ZIZ} be a subgroup of G3. Each member of S3 fixes a 
subspace. ZZI fixes the states |000), 1 001) , 1 110) , and 1 1 1 1 ) . Similarly, IZZ stabilizes the 
states |000), |011), |100), and | 111). Ill stabilizes the states |000) and | 111) , while ZIZ 
stabilizes |000), |010), 1 101) , and 1 1 1 1) . The codespace is the intersection of the subspaces 
spanned by all the members of S3. So the codespace C3 = {|000), |111)}. Notice that we 



11 



did not really need to write all the four members of S3. We can represent S3 compactly 
through its generators ZZI and IZZ. We write the generator set as G§ 3 = {ZZI, IZZ). 
With these two generators we can generate S3 as follows: III = (ZZI)(ZZI) and 
ZIZ = (ZZI)(IZZ). So when we give a description of a code in terms of its stabilizers, 
we mean the stabilizer generators. The stabilizer generators form an independent set, in 
the sense that no generator is a product of two or more generators. In the section on the 
conversion of stabilizer generators to binary matrices, this translates into the rows of the 
matrix being linearly independent — no row in the matrix can be obtained by the product 
of two or more rows. The stabilizer for a quantum error-correcting code cannot contain 
the element —I. To see this assume that the codespace is not the trivial subspace. Let 
be a state that is stabilized —I. This implies that —I\ip) = \ip), which would mean 
that \ip) is the trivial state, and hence a trivial subspace which we assumed was not the 
case. The stabilizer generators must all commute to constitute a valid codespace. These 
stabilizer generators for quantum codes function as parity check matrices for classical 
linear codes. 

An element g\ 7^ ±7 from the set G n has two eigenspaces labeled by eigenvalue 
+1 and -1 of equal size 2 n /2 = 2 n_1 . Now pick another element 52 from G n different 
from both ±1 and g\, but which commutes with g\. §2 also has two eigenspaces of 
equal size 2 n ~ 1 labeled by eigenvalue +1 and -1. But since g\ and §2 commute they 
have simultaneous eigenspaces. So both operators can now stabilize quantum states 
in four eigenspaces which we label as {++,H — , — h, — }• Each eigenspace has size 
2 n /2 2 = 2 n ~ 2 . In this way we can keep picking up elements from G n and subdividing 
the 2 n dimensional Hilbert space into subspaces of equal sizes. These subspaces are all 
orthogonal to each other. So if we choose n — k elements g±, g2, ■ ■ ■ , g n -k horn G n such 
that they all commute with each other and none is equal to ±7, then we end up dividing 
the Hilbert space into 2 n ~ fc subspaces each of size 2 k . Call this set S n . Clearly S n C G n - 

We can label these subspaces as {+ + ... +, — h ...+,... , ... — }. So each subspace 

can contain a Hilbert space of k qubits. We choose a special subspace represented by 
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Figure 2.1: Steps in quantum error-correction. Thin lines denote quantum information 
and thick lines denote classical information. Slanted bars denote multiple qubits. Alice 
the sender of quantum information encodes a multi-qubit state \tp) using ancilla qubits 
|0). She sends the encoded state over a noisy quantum channel. Bob on receiving the 
quantum information performs multi-qubit measurements to extract classical information 
about the errors. He finally performs a recovery operation R to reverse the channel error. 
This recovery operation is composed of firstly correcting the errors and secondly decoding 
the corrected state. 



the label + + ...+ which is the simultaneous +1 eigenspace of the elements of § n . We 
call this subspace the codespace and it represents a quantum error-correcting code that 
encodes k logical qubits into n physical qubits, and we indicate this as [[n, A;]]. There is 
nothing special about the simultaneous +1 eigenspace. We could have easily chosen any 
of the other subspaces as well. So in addition to the commutation property, the stabilizer 
generators must all have eigenvalues equal to +1. When an error occurs it moves the 
codeword out of the simultaneous +1 eigenspace into one of the orthogonal subspaces. 
It is this orthogonality property of these subspaces that allows us to detect the error and 
safely recover from it. We can multiply the stabilizer generators and obtain an equivalent 
representation. This operation would be equivalent to adding bases together in vector 
notation. In the next section we list the steps of how a quantum error-correcting code 
operates. 
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2.2 Quantum Error-Correction 

An [[n, k]] quantum error-correcting code operates when: 

(i). Alice encodes her k qubits of quantum information along with n — k ancilla qubits 
|0)® n ~ fc into the general multi-qubit state \ip). She encodes this into the simulta- 
neous +l-eigenspace of the stabilizer generators gi,g2, ■ ■ ■ ,9n-k as shown in Fig- 



ure 2.1 In this way, Alice has encoded k logical qubits into n physical qubits. 



(ii) . Alice sends her re-qubit state (quantum codeword) over a noisy quantum channel 

to Bob, using the channel n times. 

(iii) . Bob on receiving the codeword performs a measurement of the n — k stabilizer gen- 

erators to determine if an error has occurred. Recall that the stabilizer generators 
are composed from Pauli matrices which are Hermitian and hence valid observables 
on which one can perform measurements and obtain classical information. In the 
ideal case when no errors occur, the measurement will give Bob a bit-string of n — k 
+1 values. When an error occurs the codeword moves out of the +l-eigenspace 
to one of the the other 2 n ~ k — 1 subspaces. When a measurement of a stabilizer 
generators gives Bob a value of -1, then he knows exactly which error has occurred 
as this new bit-string differs from the all +1 bit-string, and he can undo that error 
by reapplying the error on that particular qubit. These measurements performed 
by Bob do not disturb the original quantum state. Moreover it suffices to correct 
only a discrete set of errors £ even though errors in quantum information can be 
continuous [HI [38] . £ is a subset of the general Pauli group G n . Bob can uniquely 
identify which error has occurred if the following condition holds: 

VE a , E b e£ 3 gi eS n : \gi, E\E b } = or E\E h G S„. (2.3) 



What the above condition is stating is that as long as an error anticommutes 
with one of the stabilizer generators, Bob ought to be able to detect this. This is 
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Figure 2.2: Alice encodes her one qubit of quantum information with the help of two 
ancilla qubits using the encoding unitary shown in the dashed red box in the left side of 
the figure. She sends the codeword to Bob who uses the error-diagnosis circuit shown in 
the dashed blue box. The result of this measurement is projected on to the two ancilla 
qubits at the bottom. The information from these ancillas (syndrome result) is then 
used to apply the recovery procedure. Bob can now finally decode the quantum state to 
obtain the original one qubit of quantum information. 



the active correction part. The second condition says that there can be "error" 
operators that commute with the stabilizer generators. These are undetectable by 
Bob, however, Bob does not care about them. This is the passive correction part. 

(iv). If Bob can diagnose which error has occurred, he can correct for it during the 



recovery procedure as shown in Figure 2.1 Once he obtains the corrected codeword, 



he can decode it to obtain the original k information qubits. 

We now give a specific example of the [[3,1]] stabilizer code that can correct a single bit- 
flip error. With this code Alice can encode one logical qubit into three physical qubits. 
So n = 3 and k = 1. This code has n — k = 3 — 1 = 2 stabilizer generators. These are 



gi = ZZI and 52 = IZZ. The codewords for this code are |000) and [111). Figure 2.2 
shows the encoding unitary, the error diagnosis and recovery circuits as well as the 
decoding unitary. The bit patterns corresponding to bit-flip errors are: X\ = XII = 
{-1, +1} , X 2 = IXI = {-1, -1} , X 3 = IIX = {+1, -1} , I = III = {+1, +1}. Since 
the [[3, 1]] code is a very simple code, the encoding unitary circuits are sparse. In a later 
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Target 


Conjugation 


Target 
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HIW 
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HXW 
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Y 




-Y 


Z 




X 



Table 2.1: Hadamard transformation of the Pauli matrices. 



Target 


Conjugation 


Target 


I 


PIP^ 


I 


X 


PXP^ 


Y 


Y 


PYPl 


X 


Z 


PZPl 


Z 



Table 2.2: Phase transformation of the Pauli matrices. 

chapter when we exploit quantum error-correcting codes to hide quantum information we 
will deal with the [[7, 1]] Steane code whose encoding unitary circuit consists of thirty-six 
quantum gates! 



2.3 Encoding Unitary 



The stabilizer generators also give us a way to generate the encoding circuit for any 
stabilizer code. These unitaries belong to a special class called Clifford unitaries. What 
makes them special is that when we conjugate an element from G n with a Clifford 
unitary, it produces another element of G n . Specifically, given a Clifford unitary U and 
an element G from G n , UGU^ = G' , where G' is an element of G n . Gottesman showed 
in his thesis [22] that CNOT, Hadamard, and Phase gates are sufficient to construct any 
Clifford unitary. The CNOT acts on two qubits, whereas the Hadamard and Phase gates 
act on a single qubit. In Section 3.6 of Chapter [3j we detail an algorithm that generates 
the encoding circuit for the six-qubit code. The matrix corresponding to the Hadamard 
gate is: 

1 



H 



V2 



1 1 
1 -1 



(2.4) 
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Table 2.3: CNOT transformation of two qubits. 
The matrix for the Phase gate is: 



P 



1 

i 



The matrix for the CNOT is slightly more complicated: 



CNOT 



10 
10 
1 
10 



(2.5) 



(2.6) 



The standard basis for the one qubit Pauli group G\ is X and Z. We list the transfor- 



mation of this basis under conjugation with the Hadamard and Phase gates in Table 2.1 



and in Table 2.2 respectively. We list the conjugate transformation of two-qubit Pauli 



matrices with the CNOT gate in Table 2.3 These tables will be useful in the thesis 
later when we calculate the encoding of various error operators. 
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2.4 Concluding Remarks 

The theory of error-correcting codes is vast and the number of papers published in 
this sub-field of quantum information science is unprecedented. We only provided the 
mathematical framework necessary to understand the results of Chapter [3j There is a 
further mathematical tool called the Pauli-to-binary isomorphism that is important in 
understanding and appreciating the results of the next chapter. Instead of reproducing 
the tool here, we refer the reader to [10J. 
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Chapter 3 

The Six-Qubit Code 



It matters if you just don't give up. 

— Stephen Hawking 

3.1 Introduction 

It has been more than a decade since Peter Shor's seminal paper on quantum error 
correction [17]. He showed how to protect one qubit against decoherence by encoding it 
into a subspace of a Hilbert space larger than its own. For the first time, it was possible 
to think about quantum computation from a practical standpoint. 

Calderbank and Shor then provided asymptotic rates for the existence of quantum 
error-correcting codes and gave upper bounds for such rates j!4j . They defined a quantum 
error-correcting code as an isometric map that encodes k qubits into a subspace of the 
Hilbert space of n qubits. As long as only t or fewer qubits in the encoded state undergo 
errors, we can decode the state correctly. The notation for describing such codes is 
[[n, k, d]], where d represents the distance of the code, and the code encodes k logical 
qubits into n physical qubits. 

These earlier codes are examples of additive or stabilizer codes. Additive codes encode 
quantum information into the +1 eigenstates of n-fold tensor products of Pauli operators 
|23l [22] . Gottesman developed an elegant theory, the stabilizer formalism, that describes 
error correction, detection, and recovery in terms of algebraic group theory [22] . 
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Steane constructed a seven-qubit code that encodes one qubit, corrects an arbitrary 
single-qubit error, and is an example of a Calderbank-Shor-Steane (CSS) code [50]. The 
five-qubit quantum error-correcting code is a "perfect code" in the sense that it encodes 
one qubit with the smallest number of physical qubits while still correcting an arbitrary 
single-qubit error j3Ul E] ■ 

Even though every stabilizer code is useful for fault-tolerant computation |23l [22], 
CSS codes allow for simpler fault-tolerant procedures. For example, an encoded CNOT 
gate admits a transversal implementation without the use of ancillas if and only if the 
code is of the CSS type [22]. The five-qubit code is not a CSS code and does not possess 
the simple fault-tolerant properties of CSS codes |38j. The Steane code is a CSS code 
and is well-suited for fault-tolerant computation because it has bitwise implementations 
of the Hadamard and the phase gates as well (the logical X and Z operators have bitwise 
implementations for any stabilizer code [23]). However, an experimental realization of 
the seven-qubit code may be more difficult to achieve than one for the five-qubit code 
because it uses two additional physical qubits for encoding. 

Calderbank et al. discovered two distinct six-qubit quantum codes [13J which encode 
one qubit and correct an arbitrary single-qubit error. They discovered the first of these 
codes by extending the five-qubit code and the other one through an exhaustive search 
of the encoding space. Neither of these codes is a CSS code. 

The five-qubit code and the Steane code have been studied extensively [35], but the 
possibility for encoding one qubit into six has not received much attention except for the 
brief mention in Ref. [13 . In this thesis, we bridge the gap between the five-qubit code 
and the Steane code by discussing two examples of a six-qubit code. We also present 
several proofs concerning the existence of single-error-correcting CSS codes of a certain 
size. One of our proofs gives insight into why Calderbank et al. were unable to find a 
six-qubit CSS code. The other proofs use a technique similar to the first proof to show 
the non-existence of a CSS entanglement-assisted code that uses fewer than six local 
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physical qubits where one of the local qubits is half of one ebit, and corrects an arbitrary 
single-qubit error. 

We structure our work according to our four main results. We first present a degen- 
erate six-qubit quantum code and show how to convert this code to a subsystem code. 
Our second result is a proof for the non-existence of a single-error-correcting CSS six- 
qubit code. Our third result is the construction of a six-qubit CSS entanglement-assisted 
quantum code. This code is globally equivalent to the Steane code. We finally show that 
the latter is the smallest example of an entanglement-assisted CSS code that corrects an 
arbitrary single-qubit error. 



In Section 3.2 we present a degenerate six-qubit quantum error-correcting code that 
corrects an arbitrary single-qubit error. We present the logical Pauli operators , CNOT 
and encoding circuit for this code. We also prove that a variation of this code gives 
us a non-trivial example of a subsystem code that saturates the subsystem Singleton 
bound [27]. 



In Section 3.3, we present a proof that a single-error-correcting CSS six-qubit code 
does not exist. Our proof enumerates all possible CSS forms for the five stabilizer 
generators of the six-qubit code and shows that none of these forms corrects the set of 
all single-qubit errors. 



Section 3.4 describes the construction of a six-qubit non-degenerate entanglement- 
assisted CSS code and presents its stabilizer generators, encoding circuit, and logical 
Pauli operators. This code encodes one logical qubit into six local physical qubits. One 
of the physical qubits used for encoding is half of an ebit that the sender shares with the 
receiver. The six-qubit entanglement-assisted code is globally equivalent to the seven- 
qubit Steane code [50] and thus corrects an arbitrary single-qubit error on all of the 
qubits (including the receiver's half of the ebit). This ability to correct errors on the 
receiver's qubits in addition to the sender's qubits is not the usual case with codes in 
the entanglement-assisted paradigm, a model that assumes the receiver's halves of the 
ebits are noise free because they are already on the receiving end of the channel. We 
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show that our example is a trivial case of a more general rule — every [[n, 1,3]] code is 
equivalent to a [[n — 1, 1,3; 1]] entanglement-assisted code by using any qubit as Bob's 
half of the ebit. 



Finally, in section 3.5, we present a proof that the Steane code is an example of the 
smallest entanglement-assisted code that corrects an arbitrary single-qubit error on the 
sender's qubits, uses only one ebit, and possesses the CSS form. 



Section |3.6| gives a procedure to obtain the encoding circuit for the six-qubit CSS 
entanglement-assisted code. It also lists a table detailing the error-correcting properties 
for the degenerate six-qubit code. 

3.2 Degenerate Six-Qubit Quantum Code 

This section details an example of a six-qubit code that corrects an arbitrary single-qubit 
error. We explicitly present the stabilizer generators, encoding circuit, logical codewords, 
logical Pauli operators and CNOT operator for this code. We also show how to convert 
this code into a subsystem code where one of the qubits is a gauge qubit. We finish this 
section by discussing the advantages and disadvantages of this code. 

Calderbank et al. mention the existence of two non-equivalent six-qubit codes [13] . 
Their first example is a trivial extension of the five-qubit code. They append an ancilla 
qubit to the five-qubit code to obtain this code. Their second example is a non-trivial 
six-qubit code. They argue that there are no other codes "up to equivalence." Our 
example is not reducible to the trivial six-qubit code because every one of its qubits is 
entangled with the others. It therefore is equivalent to the second non-trivial six-qubit 
code in Ref. |13j according to the arguments of Calderbank et al. 



Five generators specify the degenerate six-qubit code. Table 3.1 lists the generators 



hi, . . . , /15 in the stabilizer 5, and the logical operators X and Z for the six-qubit code. 



Figure 3.1 illustrates an encoding circuit for the six-qubit code. 
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Table 3.1: Stabilizer generators h%, /15, and logical operators X and Z for the 
six-qubit code. The convention in the above generators is that Y = ZX. 

The quantum error-correcting conditions guarantee that the six-qubit code corrects 
an arbitrary single-qubit error [38]. Specifically, the error-correcting conditions are as 
follows: a stabilizer S with generators Sj where i = 1, . . . , n — k (in our case n = 6 and 
k = 1), corrects an error set £ if every error pair E^E^ £ £ either anticommutes with at 
least one stabilizer generator 



3 si E S 



(3.1) 



or is in the stabilizer, 



E\E h e S. 



(3.2) 



These conditions imply the ability to correct any linear combination of errors in the 
set £ [38|, I36j. At least one generator from the six-qubit stabilizer anticommutes with 
each of the single-qubit Pauli errors, Xi, Yi, Z{ where i = 1, . . . , 6, because the generators 
have at least one Z and one X operator in all six positions. Additionally, at least one 
generator from the stabilizer anticommutes with each pair of two distinct Pauli errors 



(except Z^Zq, which is in the stabilizer S). Table 3.4 lists such a generator for every pair 
of distinct Pauli errors for the six-qubit code. These arguments and the table listings 
prove that the code can correct an arbitrary single-qubit error. The logical basis states 
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Figure 3.1: Encoding circuit for the first six-qubit code. The H gate is a Hadamard 
gate. For example, we apply a Hadamard on qubit four followed by a CNOT with qubit 
four as the control qubit and qubit six as the target qubit. 



for the six-qubit code are as follows: 

|0) 



ID 



1000000) - |100111) + |001111) - 1 101000) - 
|010010) + |110101) + |011101) - |111010) 

1001010) + |101101) + 1000101) + 1 100010) - 
|011000) - |111111) + |010111) + 1 110000) 



where we suppress the normalization factors of the above codewords. 

A series of CNOT and controlled-Z operations implement the logical CNOT operation 
for the six-qubit code. Let CN(i, j) denote a CNOT acting on physical qubits i and j 
with qubit % as the control and qubit j as the target. Let CZ(i,j) denote controlled-Z 
operations. The logical CNOT for the six-qubit code is as follows: 



CNOT = CZ(2,7) CZ(5,7) CZ(6,7) CN(1,9) 

CN(3,9) CN(4,9) CN(2,11) CN(4,11) CN(5,11) 



Figure 3^ depicts the logical CNOT acting on two logical qubits encoded with the six- 
qubit code. 
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Figure 3.2: Logical CNOT for the six-qubit quantum code. The first six qubits represent 
a logical source qubit and the last six represent a logical target qubit. For example we 
begin the circuit by applying a CZ (controlled-Z) gate from source qubit two to target 
qubit seven. 

Both the six-qubit code and the five-qubit code correct an arbitrary single-qubit 
error. But the six-qubit code has the advantage that it corrects a larger set of errors 
than the five-qubit code. This error-correcting capability comes at the expense of a 
larger number of qubits — it corrects a larger set of errors because the Hilbert space for 
encoding is larger than that for the five-qubit code. In comparison to the Steane code, 
the six-qubit code uses a smaller number of qubits, but the disadvantage is that it does 
not admit a simple transversal implementation of the logical CNOT. In addition, the 
Steane code admits a bitwise implementation of all logical single-qubit Clifford gates 
whereas the six-qubit code does not. 



3.2.1 Subsystem Code Construction 

We convert the degenerate six-qubit code from the previous section into a subsystem 
code. The degeneracy inherent in the code allows us to perform this conversion. The 
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code still corrects an arbitrary single-qubit error after we replace one of the unencoded 
ancilla qubits with a gauge qubit. 

We briefly review the history of subsystem codes. The essential insight of Knill et 
al. was that the most general way to encode quantum information is into a subsystem 
rather than a subspace |28j . In the case when the information is encoded in a single 
subsystem, the Hilbert space decomposes as % = ('Ha'^'Hb) ®T~ic where the subsystem 
*Ha stores the protected information. Errors that act on subsystem He, also known as 
the gauge subsystem, do not require active correction because Hb does not store any 
valuable information. This passive error-correction ability of a subsystem code may lead 
to a smaller number of stabilizer measurements during the recovery process and may 
lead to an improvement of the accuracy threshold for quantum computation [T]. Kribs 
et al. recognized in Ref. [29j that this subsystem structure of a Hilbert space is useful 
for active quantum error-correction as well (Knill et al. did not explicitly recognize this 
ability in Ref. [2S].) 

We now detail how to convert the six-qubit code from the previous section into a 
subsystem code. The sixth unencoded qubit is the information qubit and the encoding 
operation transforms it into subsystem %a- We convert the fourth unencoded ancilla 
qubit to a gauge qubit. We simply consider it as a noisy qubit so that the operators 
X4 and Z4 have no effect on the quantum information stored in subsystem Ha- The 
operators X4 and Z4 generate the unencoded gauge group. The encoding circuit in 



Figure 3.1 transforms these unencoded operators into X4 and Z^Zq respectively. These 
operators together generate the encoded gauge subgroup H = (X^Z^Zq). Errors in 
this subgroup do not affect the encoded quantum information. The code is still able 
to correct an arbitrary single-qubit error because each one of the single-qubit Pauli 
error pairs anticommutes with at least one of the generators from the new stabilizer 



S = (h\, /i2, /13, /15), or belong to H [35]. Table 3.4 shows this property for all error pairs. 
The code passively corrects the error pairs X4, Z^Z^, Y^Zq because they belong to the 
gauge subgroup. 
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Table 3.2: Stabilizer generators /ii,/i2j^3 and h§, gauge subgroup generators Hx and 
Hz, and logical operators X and Z for the six-qubit code. The convention in the above 
generators is that Y = ZX. 

The six-qubit single-error-correcting subsystem code discussed above saturates the 
Singleton bound for subsystem codes [27] , 

n-k-r>2(d-l), (3.3) 

where for our code, n = 6, k = 1, r = 1, and d = 3. This code is the smallest non-trivial 
subsystem code that corrects an arbitrary single-qubit error Q One of the advantages 
of using the subsystem construction is that we only need to perform four stabilizer 
measurements instead of five during the recovery process. 

3.3 Non-existence of a [[6, 1,3]] CSS Code 

Our proposition below proves that it is impossible for a six-qubit code to possess the CSS 
structure while correcting an arbitrary single-qubit error. An immediate corollary of this 
proposition is that the seven-qubit code is the smallest single-error-correcting CSS code. 

Proposition 3.3.1. There is no six-qubit code that encodes one qubit, possesses the CSS 
structure, and corrects an arbitrary single-qubit error. 



A trivial way to saturate this bound is to add a noisy qubit to the five-qubit code! 
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Proof. We first suppose that a code with the above properties exists. If a [[6, 1, 3]] CSS 
code exists, its stabilizer S must have five generators: 

S = {gi,..., g 5 ). (3.4) 

The CSS structure implies that each of these generators includes X operators only or Z 
operators only (except for the identity). The set of correctable Pauli errors {Ej} in the 
Pauli group acting on six qubits satisfies {EiEj,S} = unless EiEj G S, for all We 
show below that no set of five CSS stabilizer generators acting on six qubits can correct 
an arbitrary single-qubit error and possess the CSS structure. 

First assume that such generators exist. It is not possible that all generators consist 
of the same type of operators (all X or all Z) because single-qubit errors of the same type 
{X or Z) are then not correctable. Consider the possibility that there is one generator 
of one type, say X, and four generators of the other type, say Z. If the generator of type 
X has an identity acting on any qubit, say the first one, then the error Z\ commutes 
with all generators. This error is not correctable unless it belongs to the stabilizer. But 
if it belongs to the stabilizer, the first qubit of the code must be fixed in the state |0), 
which makes for a trivial code. The other possibility is that the X-type generator has 
the form g\ = XXXXXX . But then any combination of two Z-errors (Z{Zj) commutes 
with it, and so they have to belong to the stabilizer. But there are five independent such 
combinations of errors (Z1Z2, Z1Z3, Z\Z^, Z\Z^, Z\Z§) and only four generators of the 
Z type. Therefore, it is impossible for the code to have four generators of one type and 
one generator of the other type. 

The only possibility left is that there are two generators of one type, say X, and three 
generators of the other type, say Z. The two X-type generators should not both have 
identity acting on any given qubit because a Z error on that qubit commutes with all 
generators. Such an error cannot belong to the stabilizer because it would again make 
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for a trivial code. Specifically, we write the two X-type generators (gi and g 2 ) one above 
the other 

91 = " , (3.5) 

52 ------ 

where we leave the entries unspecified in the above equation, but they are either X or 
/. Both generators cannot have the column 



I 
/ 



in (3.5) because both generators cannot have identities acting on the same qubit. Thus, 



only three different columns can build up the generators in (3.5): 



I X X 

XIX 

We distinguish the following cases: 

(i) . Each column appears twice. 

(ii) . One column appears three times, another column appears twice, and the third 

column appears once. 

(iii) . One column appears three times and another column appears three times. 

(iv) . At least one column appears more than three times. 

If one and the same column appears on two different places, say qubit one and qubit two 
as in the following example, 



gi X X - - - - 

(3.6) 

g 2 I I - - - - 
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then a pair of Z errors on these qubits {Z\Z-i) commutes with all generators, and therefore 
belongs to the stabilizer. 

In the first case considered above, there are three such pairs of errors, which up to 
a relabeling of the qubits can be taken to be Z\Zi, Z^Z^ Z^Z^,. They can be used as 
stabilizer generators because these operators are independent. But then the following 
pairs of single-qubit X errors commute with all generators: X1X2, X3X4, X$Xq. This 
possibility is ruled out because the latter cannot be part of the stabilizer generators. 

In the second case, up to a relabeling of the qubits, we have the following pairs of Z 
errors that commute with the stabilizer: Z\Zi, Z\Z%, Z2Z3, Z4Z5. Only three of all four 
are independent, and they can be taken to be stabilizer generators. But then all three 
generators of Z-type have the identity acting on the sixth qubit, and therefore the error 
Xq is not correctable (and it cannot be a stabilizer generator because it would make for 
a trivial code) . 

In the third case, the pairs Z1Z2, Z1Z3, Z2Z3, Z4Z5, Z4ZQ, Z^Zq (up to a relabeling), 
four of which are independent, commute with the stabilizer. But they cannot all belong 
to the stabilizer because there are only three possible generators of the Z-type. 

Finally, in the fourth case, we have three or more independent pairs of Z errors 
commuting with the stabilizer (for example Z1Z2, Z1Z3, Z1Z4, which corresponds to 
the first four columns being identical). If the independent pairs are more than three, 
then their number is more than the possible number of generators. If they are exactly 
three, we can take them as generators. But then Z-type generators act trivially upon 
two qubits, and therefore X errors on these qubits are not correctable. This last step 
completes the proof. □ 
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3.4 Non-degenerate Six-Qubit CSS Entanglement- 
Assisted Quantum Code 

We detail the construction of a six-qubit CSS entanglement-assisted quantum code in this 
section. We first review the history of entanglement-assisted quantum coding and discuss 
the operation of an entanglement-assisted code. We then describe our construction. It 
turns out that the code we obtain is equivalent to the Steane code [50] when including 
Bob's qubit, and therefore is not a new code. It suggests, however, a general rule 
for which we present a proof — every [[n, 1,3]] code is equivalent to a [[n — 1, 1, 3; 1]] 
entanglement-assisted code with any qubit serving as Bob's half of the ebit. Even though 
our code is a trivial example of this rule, it is instructive to present its derivation from 
the perspective of the theory of entanglement-assisted codes. 

Bowen constructed an example of a quantum error-correcting code that exploits 
shared entanglement between sender and receiver [Sj. Brun, Devetak, and Hsieh later 
generalized Bowen's example and developed the entanglement-assisted stabilizer formal- 
ism |10| [TT] . This theory is an extension of the standard stabilizer formalism and uses 
shared entanglement to formulate stabilizer codes. Several references provide a review 
|10[ [TT| [26] and generalizations of the theory to entanglement-assisted operator codes 
[121 126] , convolutional entanglement distillation protocols [56] , continuous- variable codes 
[57], and entanglement-assisted quantum convolutional codes [55] , Gilbert et al. also 
generalized their "quantum computer condition" for fault tolerance to the entanglement- 
assisted case |21j . Entanglement-assisted codes are a special case of "correlation-assisted 
codes", where Bob's qubit is also allowed to be noisy. Such codes are in turn instances 
of general linear quantum error-correcting codes [42]. 

An entanglement-assisted quantum error-correcting code operates as follows. A 
sender and receiver share c ebits before communication takes place. The sender pos- 
sesses her half of the c ebits, n — k — c ancilla qubits, and k information qubits. She 
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performs an encoding unitary on her n qubits and sends them over a noisy quantum com- 
munication channel. The receiver combines his half of the c ebits with the n encoded 
qubits and performs measurements on all of the qubits to diagnose the errors from the 
noisy channel. The generators corresponding to the measurements on all of the qubits 
form a commuting set. The generators thus form a valid stabilizer, they do not disturb 
the encoded quantum information, and they learn only about the errors from the noisy 
channel. The notation for such a code is [[n, k, d; c]], where d is the distance of the code. 

The typical assumption for an entanglement-assisted quantum code is that noise 
does not affect Bob's half of the ebits because they reside on the other side of a noisy 
quantum communication channel between Alice and Bob. Our [[6, 1, 3; 1]] entanglement- 
assisted code is globally equivalent to the [[7, 1, 3]] Steane code and thus corrects errors 
on Bob's side as well. From a computational perspective, a code that corrects errors 
on all qubits is more powerful than a code that does not. From the perspective of the 
entanglement-assisted paradigm, however, this feature is unnecessary and may result in 
decreased error-correcting capabilities of the code with respect to errors on Alice's side. 

We construct our code using the parity check matrix of a classical code. Consider 
the parity check matrix for the [7, 4, 3] Hamming code: 



The Hamming code encodes four classical bits and corrects a single-bit error. We remove 
one column of the above parity check matrix to form a new parity check matrix H as 
follows: 



10 10 11 



10 110 1 



(3.7) 



10 111 



10 10 1 



H = 



10 110 



(3.8) 



10 11 
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The code corresponding to H encodes three bits and still corrects a single-bit error. We 
begin constructing the stabilizer for an entanglement-assisted quantum code by using 
the CSS construction p72]. [26] : 

n n 

(3.9) 

The left side of the above matrix is the "Z" side and the right side of the above matrix 
is the "X" side. The isomorphism between n-fold tensor products of Pauli matrices and 



H 








H 



n-dimensional binary vectors gives a correspondence between the matrix in (3.9) and the 
set of Pauli generators below [221 GS El] : 
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(3.10) 



The above set of generators have good quantum error-correcting properties because they 
correct an arbitrary single-qubit error. These properties follow directly from the proper- 
ties of the classical code. The problem with the above generators is that they do not form 
a commuting set and thus do not correspond to a valid quantum code. We use entan- 
glement to resolve this problem by employing the method outlined in Ref . |1U| ITU [2"S] . 



Three different but related methods determine the minimum number of ebits that 
the entanglement-assisted quantum code requires: 

(i). Multiplication of the above generators with one another according to the "sym- 
plectic Gram-Schmidt orthogonalization algorithm" forms a new set of generators 
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(b) 



Table 3.3: (a) The generators and logical operators for the unencoded state. Generators 
g' 3 and g' e indicate that Alice and Bob share an ebit. Alice's half of the ebit is her first 
qubit and Bob's qubit is the other half of the ebit. Generators g[, g' 2 , g'4, and g' 5 indicate 
that Alice's second, third, fourth, and fifth respective qubits are ancilla qubits in the 
state |0). The unencoded logical operators X' and Z' act on the sixth qubit and indicate 
that the sixth qubit is the information qubit. (b) The encoded generators and logical 
operators for the [[6, 1, 3; 1]] entanglement-assisted quantum error-correcting code. 

|1Q|. [TT] . The error-correcting properties of the code are invariant under these mul- 
tiplications because the code is an additive code. The resulting code has equivalent 
error-correcting properties and uses the minimum number of ebits. We employ this 
technique in this work. 

(ii) . A slightly different algorithm in the appendix of Ref. [56 1 determines the minimum 

number of ebits required, the stabilizer measurements to perform, and the local 
encoding unitary that Alice performs to rotate the unencoded state to the encoded 
state. This algorithm is the most useful because it "kills three birds with one 
stone." 

(iii) . The minimum number of ebits for a CSS entanglement-assisted code is equal to the 

rank of HH T |12l [26] . This simple formula is useful if we are only concerned with 
computing the minimum number of ebits. It does not determine the stabilizer 
generators or the encoding circuit. Our code requires one ebit to form a valid 
stabilizer code because the rank of HH T for our code is equal to one. 
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Table |3.3[ b) gives the final form of the stabilizer for our entanglement-assisted six- 
qubit code. We list both the unencoded and the encoded generators for this code in 
Table O 

Our code uses one ebit shared between sender and receiver in the encoding process. 
The sender performs a local encoding unitary that encodes one qubit with the help of 
four ancilla qubits and one ebit. 

The symplectic Gram-Schmidt algorithm yields a symplectic matrix that rotates 
the unencoded symplectic vectors to the encoded symplectic vectors. The symplectic 
matrix corresponds to an encoding unitary acting on the unencoded quantum state 
\10\ ITT] . This correspondence results from the Stone- von Neumann Theorem and unifies 
the Schrodinger and Heisenberg pictures for quantum error correction |17j . 

The symplectic Gram-Schmidt algorithm also determines the logical operators for the 
code. Some of the vectors in the symplectic matrix that do not correspond to a stabilizer 
generator are equivalent to the logical operators for the code. It is straightforward 
to determine which symplectic vector corresponds to which logical operator (X or Z) 
by observing the action of the symplectic matrix on vectors that correspond to the 
unencoded X or Z logical operators. 
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For our code, the symplectic matrix is as follows: 



10 10 1 
10 1110 
110 11 


110 10 



1 1 
10 10 1 







110 11 
1110 1 

10 10 1 
1111 
10 10 


1 1 1 



(3.11) 



The index of the rows of the above matrix corresponds to the operators in the unencoded 
stabilizer in Table [3~3| a). Therefore, the first five rows correspond to the encoded Z 
operators in the stabilizer and the sixth row corresponds to the logical Z operator. As 
an example, we can represent the unencoded logical Z operator in Table 
following binary vector: 



3.3 a) as the 



1 







(3.12) 



Premultiplying the above matrix by the above row vector gives the binary form for the 
encoded logical Z operator. We can then translate this binary vector to a six-fold tensor 



product of Paulis equivalent to the logical Z operator in Table 3.3 'b). Using this same 



idea, the first row of the above matrix corresponds to Alice's Paulis in g%, the second 
row to gi, the third row to g<i ; the fourth row to (74, the fifth row to 55, and the seventh 
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Figure 3.3: Encoding circuit for the [[6,1,3;!]] code. The "H" gate is a Hadamard gate. 



row to g§ ■ The last six rows in the above matrix correspond to encoded X operators and 
it is only the last row that is interesting because it acts as a logical X operator. 



Figure 3^ gives the encoding circuit for the code. 

We now detail the operations that give the equivalence of this code to the seven-qubit 
Steane code. Consider the generators in Table [3^b). Label the columns from left to 
right as 1, 2, . . . , 7 where "1" corresponds to Bob's column. Replace the generator g\ 
by g\gi9z-, and the generator 55 by 55^6- Switch the new generators 54 and 55. Switch 
columns 2 and 3. Switch columns 1 and 5. Cyclically permute the columns once so that 

1 becomes 7, 2 becomes 1, 3 becomes 2, 7 becomes 6. The resulting code is exactly 
the Steane code if one reads it from right to left (i.e., up to the permutation 1 -R- 7, 

2 o 6, 3 o 5). 

Inspection of the encoded logical operators in Table |3.3[ b) reveals that Alice can 
perform logical X and Z operations locally. Since the CNOT has a transversal imple- 
mentation for the Steane code, if Alice and Bob possess two logical qubits each encoded 
with this entanglement-assisted code, they can apply an encoded CNOT transversally 
by the use of classical communication to coordinate their actions. We point out, how- 
ever, that the idea of computation in the entanglement-assisted paradigm is not well 
motivated, since if classical communication is allowed, Alice could send the initial state 



37 



to Bob and inform him of the operations that need to be applied. An interesting open 
question is if there exist codes that allow fault-tolerant computation on Alice's side only. 

Prom this example, we observe that some subset of the entanglement-assisted codes 
correct errors on Bob's side. This phenomenon can be understood as an instance of 
the more general correlation-assisted codes and linear quantum error-correction theory 
detailed in Ref. |42j . It may be useful from a practical standpoint to determine which 
entanglement-assisted codes satisfy this property. Here we provide an answer for the 
case of single-error-correcting codes that use one bit of entanglement. 

Proposition 3.4.1. Every [[n, 1, 3]] code is equivalent to a [[n — 1, 1, 3; 1]] code with any 
qubit serving as Bob 's half of the ebit. 

Proof. We prove this proposition by showing that any column in the table of stabilizer 
generators for such a code can be reduced to the standard form of Bob's column in an 
entanglement-assisted code (containing exactly one X and one Z operator). Without 
loss of generality, consider the column corresponding to the first qubit. This column 
generally may contain X, Y, Z, or I operators, but if the code corrects any error on the 
first qubit, there must be at least two different Pauli operators in this column. We can 
reduce this column to the desired form as follows. Choose one of the generators that 
contains X on the first qubit, and replace each of the other generators that contain an 
X there by its product with the chosen generator. Do the same for Y and Z. Thus we 
are left with at most one generator with X, one with Y and one with Z. To eliminate Y, 
we replace it by its product with the X and Z generators. If either X or Z is missing, 
we replace the Y generator with its product with the other non-trivial generator. □ 

This result can be understood as a reflection of the fact that in a code that corrects 
arbitrary single-qubit errors, every qubit is maximally entangled with the rest and there- 
fore can be thought of as part of an ebit. The latter can also be seen to follow from 
the property that every single-qubit error must send the code space to an orthogonal 
subspace. 
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Note that for the case of [[n, l,3;c]] codes with c > 1, the relation could be more 
complicated. If such a code corrects an arbitrary single-qubit error, it is equivalent to an 
[[n + c, 1, 3]] code, but it is not obvious whether a [[n + c, 1, 3]] code can be interpreted 
as a [[n, 1, 3; c]] code because the type of entanglement that exists between c qubits and 
the rest n qubits may not be the same as that of c e-bits. 

3.5 Non-existence of [[n, 1,3; 1]] CSS codes for n < 5 

We now show that there does not exist a smaller entanglement-assisted CSS code that 
uses only one ebit and corrects an arbitrary single-qubit error on Alice's side. The proof 
is similar to that for the non-existence of a [[6, 1,3]] CSS code. 

Proposition 3.5.1. There does not exist an [[n, 1,3; 1]] entanglement-assisted CSS code 
for n < 5. 

Proof. We being this proof by giving a dimensionality argument for the non-existence of 
quantum codes (CSS or non-CSS) with n < 4. This can be easily seen as follows. Assume 
that the code is non-degenerate. There are 3n different single-qubit errors on Alice's side, 
which means that there must exist 3n + 1 orthogonal subspaces of dimension 2 inside 
the entire 2 n+1 -dimensional Hilbert space, i.e., (3n + 1)2 < 2 n+1 . This is impossible for 
n < 4. Since for n < 3 the number of generators is at most 3, and two of the generators 
have to act non-trivially on Bob's side, we can have degeneracy with respect to errors 
on Alice's side only for n = 3 with exactly one of the generators being equal to a pair of 
errors on Alice's side. These two errors would be the only indistinguishable single-qubit 
errors on Alice's side (no other pair of errors on Alice's side can belong to the stabilizer), 
which reduces the number of required orthogonal subspaces from 3 x 3 + 1 = 10 to 9. 
The required dimensions are 2 x 9 = 18 and they cannot fit in the 2 4 = 16-dimensional 
Hilbert space. 
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Suppose that there exists a [[5, 1, 3; 1]] CSS code. Its stabilizer must have 5 generators 
(S = (gi, ...,55)), each consisting of only A and / operators or Z and I operators. For 
an entanglement-assisted code, the generators must be of the form 



9i 

92 
93 
94 

95 



X 
Z 
I 
I 
I 



(3.13) 



where we have left the entries on Alice's side unspecified. The set of correctable Pauli 
errors on Alice's side {Ej £ V$} (where V5 is the five-qubit Pauli group) must satisfy 
{EiEj, S} = unless E\Ej € S, for all i, j = 1, 2, 3, 4, 5. All generators cannot be of the 
same type (X or Z). The possibility that there is one generator of one type, say X, and 
four generators of the other (Z) type, is also ruled out because the A-type generator 
would have to be of the form g\ = AAAAAjA in order that every qubit is acted upon 
non-trivially by at least one X operator from the stabilizer. This would mean, however, 
that any combination of two Z-errors (ZiZj, i,j = 1,2,3,4,5) would commute with the 
stabilizer, and so it would have to belong to the stabilizer. There are four independent 
such combinations of errors (ZiZ2,ZiZ3,ZiZ4,ZiZs) which would have to be the other 
four generators. But then there would be no possibility for a Z operator on Bob's side 
(as in (72)- Therefore, this is impossible. 

The only possibility is that there are 2 generators of one type, say A, and 3 generators 
of the other type (Z). The two A- type generators should not both have identity acting 
on any given qubit on Alice's side because a Z error on that qubit would commute with 
all generators. Consider the following form for the two A-type generators: 



91 

93 



X 
I 



(3.14) 
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There are three different columns that can fill the unspecified entries in the above table: 



I 

X 



X 
I 



X 
X 



We distinguish the following cases: two columns appear twice and one column appears 
once, one column appears three times and another column appears twice, one column 
appears three times and each of the other columns appears once, at least one column 
appears more than three times. 

In the first case, up to relabeling of the qubits, we distinguish the following possibil- 
ities: 

g[= I I X X X X 
XXI I X I 



93 



g'l 
a'l 



9s" 



(3.15) 



X X I I X 

X X X X I 

X X X X I 

X X I I X 



X 

I 

X 

I 



(3.16) 



(3.17) 



For each possibility, the pairs of errors Z1Z2 and Z3Z4 commute with the stabilizer and 
therefore they would have to be equal to the stabilizer generators 54 and 55. But the 
pairs of errors X1X2 and would commute with g±, g%, 54 and 55. Since these errors 

do not belong to the stabilizer, they would have to anti-commute with (73. Therefore, up 
to interchanging the first and second, or the third and fourth qubits, the generator 52 
must have the form 



g 3 = Z I Z I Z 



(3.18) 



(Note that the fifth entry must be Z because there must be at least one generator that 
has a Z acting on that qubit.) But it can be verified that for each of the possibilities 
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(3.15), (3.16) and (3.17), g 3 anti-commutes with one of the X-type generators. Therefore, 



the first case is impossible. 

In the second case, one of the possible columns appears three times and another 
column appears twice, e.g., 



gi = X X X X X 
g 3 = X X X I I 



X 
I 



(3.19) 



In such a case we would have three independent pairs of Z errors (Z1Z2, Z\Z 3 and Z^Z^) 
which commute with the stabilizer and therefore have to belong to it. But then there 
would be no possibility for a Z operator on Bob's side (the generator g<± ). Therefore this 
case is impossible. 

In the third case, one column appears three times and each other column appears 
once, as in 



gi = X X X X I 
g 3 = X X X I X 



X 
I 



(3.20) 



In this case, the pairs of errors Z\Z 2 and Z\Z 3 commute with the stabilizer and must be 
equal to 54 and #5. But in order for the fourth and fifth qubits to be each acted upon 
by at least one Z operator from the stabilizer, the generator g 2 would have to be of the 
form 

g 2 = - - - Z Z Z (3.21) 

This means that the pair of errors X4X5 commutes with the stabilizer, and since it is 
not part of the stabilizer, this case is also impossible. 

Finally, if one column appears more than three times, there would be at least three 
independent pairs of Z errors on Alice's side which have to belong to the stabilizer. 
This leaves no possibility for a Z operator on Bob's side, i.e., this case is also ruled out. 
Therefore, a [[5, 1,3; 1]] CSS code does not exist. 
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In a similar way we can show that a [[4, 1, 3; 1]] CSS code does not exist. Such a code 
would have 4 generators of the form 



9i 

92 

93 
9a 



X 
Z 
I 
I 



(3.22) 



The possibilities that all of the generators are of the same type, or that one generator is 
of one type and the other three are of the other type, are readily ruled out by arguments 
similar to those for the [[5, 1,3; 1]] code. The only possibility is two X-type generators 
and two Z-type generators. The table of the X-type generators 



9i 

93 



X 
I 



(3.23) 



has to be filled by the same three columns we discussed before. As we saw in our previous 
arguments, in the case when one column appears three or more times there are at least 
two independent pairs of errors on Alice's side which commute with the stabilizer. These 
errors would have to belong to the stabilizer, but this leaves no possibility for a Z operator 
on Bob's side. In the case when one column appears twice and another column appears 
twice, the situation is analogous. The only other case is when one column appears twice 
and each of the other two columns appears once, as in 



gi = X X I X 
g 3 = X X X I 



X 
I 



(3.24) 



Since in this case the pair of errors Z1Z2 would commute with the stabilizer, this pair 
would have to be equal to the generator 54. The third and fourth qubits each have to be 
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acted upon by at least one Z operators from the stabilizer. Thus the generator g 2 would 
have to have the form 

g 2 = - - Z Z Z ■ (3.25) 

But then the pair X3X4 which does not belong to the stabilizer would commute with all 
stabilizer generators. Therefore a [[4, 1,3; 1]] CSS code does not exist. □ 

We point out that a [[4, 1,3;1]] non-CSS code was found in Ref. [11] . This is the 
smallest possible code that can encode one qubit with the use of only one ebit, and 
at the same time correct an arbitrary single-qubit error on Alice's side. Here we have 
identified an example of the smallest possible CSS code with these characteristics. 

3.6 Entanglement- Assisted Encoding Circuit 

Here we detail an algorithm that generates the encoding circuit for the [[6, 1, 3; 1]] code. 
We follow the recipe outlined in the appendix of Ref. [56J . We begin by first converting 
the stabilizer generators in Table [3~3] (b) into a binary form which we refer to as a Z\X 
matrix. We obtain the the left Z submatrix by inserting a "1" wherever we see a Z in 
the stabilizer generators. We obtain the X submatrix by inserting a "1" wherever we 
see a corresponding X in the stabilizer generator. If there is a Y in the generator, we 
insert a "1" in the corresponding row and column of both the Z and X submatrices. 



The idea is to convert matrix 3.26 to matrix 3.42 through a series of row and column 



operations. The binary form of the matrix in 3.26 corresponds to the stabilizer generators 



in Table [3^a). We can use CNOT, Hadamard, Phase, and SWAP gates. 

(i) . When we apply a CNOT gate from qubit i to qubit j, it adds column % to column 

j in the X submatrix, and in the Z submatrix it adds column j to column i. 

(ii) . A Hadamard on qubit % swaps column % in the Z submatrix with column % in the 

X submatrix. 
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(iii) . A Phase gate on qubit i adds column i in the X submatrix to column i in the Z 

submatrix. 

(iv) . When we apply a SWAP gate from qubit i to qubit j, we exchange column i with 

column j in Z submatrix and column % and column j in the X submatrix. 

Row operations do not change the error-correcting properties of the code. They do not 
cost us in terms of gates. They are also crucial in determining the minimum number of 
ebits for the code. 



(3.26) 



10 10 1 
10 1110 
110 11 




We begin the algorithm by computing the symplectic product [10] between the various 
rows of the matrix. The first row is symplectically orthogonal to the second row. More- 
over, it is symplectically orthogonal to all the rows except row six. So we swap the 
second row with the sixth row. 






110 11 
10 1110 
10 10 1 
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(3.27) 
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Now apply Hadamard gates to qubits, one, four and six. This operation swaps the 
columns one, four and six on the Z side with columns one, four and six on the X side. 




10 10 1 

10 10 

1 1 
10 10 
10 10 



10 10 1 



1 1 
10 10 
10 10 
10 10 



(3.28) 



Apply a CNOT from qubit one to qubit four and a CNOT from qubit one to qubit six. 
This operation adds column one to four and column one to column six on the X side. 
On the Z side of the matrix, the CNOT operation adds column four to column one and 
column six to column one. 
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gate on qubit one. 
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(3.29) 



(3.30) 
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Apply a Hadamard gate on qubit four and qubit six. This operation swaps columns four 
and six on Z side with respective columns on the X side. 



1 



10 110 





10 11 




10 10 1 

10 11 
1110 




(3.31) 



Finally, we apply a CNOT gate from qubit one to qubit four and another CNOT gate 
from qubit one to qubit six. 



1 



10 110 





10 11 





1 

10 11 
1110 




(3.32) 



At this point we are done processing qubit one and qubit two. We now proceed to 
manipulate columns two through six on the Z and X side. We apply a Hadamard gate 
on qubit two, four and five. 



1 





10 10 

1 1 

1 1 





1 
10 110 
1 
1 
1 



(3.33) 
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Perform a CNOT gate from qubit two to qubit four and from qubit two to qubit five. 
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(3.34) 



Perform a Hadamard on qubit two. 
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(3.35) 



We have processed qubit three. Now look at the submatrix from columns three to six 
on the Z and X side. Perform a SWAP gate between qubit three and qubit five. This 
operation swaps column three with five in the Z submatrix and column three and five 
in the X submatrix. 

1 

1 
1 
1 1 
1 1 
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(3.36) 



Perform a Hadamard gate on qubit three, followed by a CNOT gate from qubit three to 
qubit six, and another Hadamard on qubit three. 
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Add row four to five. 
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(3.38) 



We have completed processing qubit four. Now focus on columns four to six. Apply a 
Hadamard gate on qubit four, followed by CNOT gate from qubit four to qubit five, and 
again from qubit four to qubit six. 

1 
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1 1 
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(3.39) 



Perform a Hadamard gate on qubit four. 
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(3.40) 



Now look at columns five and six. Apply a Hadamard gate on qubit five and qubit six, 
followed by a CNOT gate from qubit five to qubit six. 
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qubit five. 
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(3.41) 



(3.42) 



We have finally obtained a binary matrix that corresponds to the canonical stabilizer 



generators in Table |3.3[a). Figure 3.3 gives the encoding circuit for the all the quantum 
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Table 3.4: Distinct pairs of single-qubit Pauli errors for the [[6, 1, 3]] quantum code. Each 
double-lined column lists a pair of single-qubit errors and a corresponding anticommuting 
generator (AG) for the code. X4 and Z4ZQ lie in the gauge subgroup H. 



operations that we performed above. Multiplying the above operations in reverse takes 
us from the unencoded canonical stabilizers to the encoded ones. 



3.7 Concluding Remarks 

We have discussed two different examples of a six-qubit code and have included a subsys- 
tem construction for the degenerate six-qubit code. Our proof explains why a six-qubit 
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CSS code does not exist and clarifies earlier results in Ref. |13] based on a search algo- 
rithm. An immediate corollary of our result is that the seven-qubit Steane code is the 
smallest CSS code capable of correcting an arbitrary single-qubit error. An interesting 
open problem is to generalize this tight lower bound to the setting of CSS codes with a 
higher distance. We expect that our proof technique may be useful for this purpose. 

Our first example is a degenerate six-qubit code that corrects an arbitrary single- 
qubit error. The presentation of the encoding circuit and the operations required for a 
logical X, Z, and CNOT should aid in the implementation and operation of this code. 
We have converted this code into a subsystem code that is non-trivial and saturates the 
subsystem Singleton bound. Our six-qubit subsystem code requires only four stabilizer 
measurements during the recovery process. This reduction in measurements may have 
implications for improving fault-tolerance thresholds. 

Our second example is an entanglement-assisted [[6, 1, 3; 1]] CSS code that is globally 
equivalent to the Steane seven-qubit code. We have presented the construction of this 
code from a set of six non-commuting generators on six qubits. We have further shown 
that every [[n, 1, 3]] code can be used as a [[n — 1, 1, 3; 1]] entanglement-assisted code. 

Based on the proof technique that we used for the earlier six-qubit code, we have 
shown that the Steane code is an example of the smallest entanglement-assisted code 
that possesses the CSS structure and uses exactly one ebit. Here too, an interesting open 
problem is the generalization of this tight lower bound to higher distance entanglement- 
assisted codes or to codes that use more than one ebit. 

Prom the next chapter we begin the theory of quantum steganography. It was impor- 
tant for us to introduce the reader to stabilizer codes as we use them extensively in 
quantum steganography to hide quantum information. 
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Chapter 4 



Classical Steganography 

What is that confers the noblest delight? What is that which swells a man's breast with 
pride above that which any other experience can bring to him? Discovery! To know that 
you are walking where none others have walked; that you are beholding what human eye 
has not seen before; that you are breathing a virgin atmosphere. To give birth to an idea 
- to discover a great thought - an intellectual nugget, right under the dust of a field that 
many a brain - plow had gone over before. To find a new planet, to invent a new hinge, 
to find the way to make the lightnings carry your messages. To be the first - that is the 
idea. To do something, say something, see something, before any body else - these are 
the things that confer a pleasure compared with which other pleasures are tame and 

commonplace, other ecstasies cheap and trivial. 

— Mark Twain 



4.1 Introduction 

We begin the second half of the thesis with a classical model of steganography which 
we later extend to a quantum one in Chapter [5j Steganography is the science of hid- 
ing a message within a larger innocent-looking plain-text message, and communicat- 
ing the resulting data over a communications channel or through a courier so that the 
steganographic message is readable only by the intended receiver. The word comes from 
the Greek words steganos which means "covered," and graphia which means "writing." 
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The art of information hiding dates back to 440 B.C. to the Greeks. In The Histo- 
ries, Herodotus records two incidents of the use of steganography. In the first incident 
Demaratus a Greek king uses a wax tablet to warn the Spartans of an impending attack 
by the Persian king Xerxes [25]. Wax tablets were used as reusable surfaces to write 
on, which were constructed on wooden bases. Demaratus scratched the steganographic 
message on the wood, and then covered it with beeswax. Once the Spartans received 
the wax tablet from the courier, all that they needed to do was to melt the beeswax 
and read the hidden warning. In another story Herodotus records how Histiaeus tattoos 
a secret message on the shaved scalp of his slave, and then waits for the hair to grow 
back before dispatching him to the Ionian city of Miletus. After arriving in Miletus, the 
slave shaves his head and reveals the secret message to the city's regent, Aristagorus, 
who upon seeing the message is encouraged to rise up against the Persian king. The 
ancient Chinese used a wooden mask with holes cut out at random places to use as a 
steganographic device. They would place the wooden block on a blank sheet of paper 
and after writing the secret message in the holes they would fill in the blanks in the 
paper with regular text. The mask acted as a secret key to unlock the hidden message. 
In the seventeenth and eighteenth centuries people used logarithmic tables to hide secret 
messages by introducing errors in the least significant digits. 

The term steganography was first used in 1499 by Johannes Trithemius in his 
Trithemius which was one of the first treatises on the use of cryptographic and stegano- 
graphic techniques. The study of modern steganography was initiated by Simmons and 
can be stated as follows |49j . Alice and Bob are imprisoned in two different cells that 
are far apart. They would like to devise an escape plan but the only way they can com- 
municate with each other is through a courier who is loyal to and under the command 
of the warden (Eve - adversary) of the penitentiary. The courier leaks all information 
to the warden. If the warden suspects that either Alice or Bob are conspiring to escape 
from the penitentiary, she will cut off all communication between them, and move both 
of them to a maximum security cell. It is assumed that prior to their incarceration Alice 
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and Bob had access to a shared secret key which they will later exploit to send secret 
messages hidden in a cover text. Can Alice and Bob devise an escape plan without 
arousing the suspicion of the warden? 

We should point out that steganography is inherently different from cryptography. In 
the latter, using an encryption algorithm the sender encrypts the secret message utilizing 
a key (private or public). The resulting message from such an encrypting procedure is 
called a "cipher-text." To an eavesdropper such as Eve, who does not have access to 
the secret key, the cipher-text looks like gibberish. If Eve observes that the transmitted 
cipher-text message is gibberish, she might realize that the message contains private 
information. In stark contrast to the latter is steganography where we do not necessarily 
need to encrypt the intended secret message. We merely hide it within a larger plain-text 
message, often referred to as the "cover-text" or "cover-work." The resulting message, 
called the "stego-text" must appear as an oblivious or benign message to Eve. In the 
usual steganographic protocol we assume that Alice and Bob have access to a secure, 
shared secret key. Alice uses this key and an embedding function to hide a secret message, 
while Bob uses the same key to extract the secret message. Alice can take this a step 
further by first encrypting the message and then hiding the resulting cipher-text inside 
the cover-text. She may use the same key to encrypt the secret message producing a 
cipher-text and then hide it within a cover-text to produce a stego-text message. Bob, 
on receiving the stego-text message would first have to extract the secret cipher-text and 
then run a decryption algorithm to obtain the final secret message. 

In this work we assume that Eve is a passive observer and all she can do is measure 
codewords. The whole point of a steganographic protocol is not to apprise Eve that Alice 
and Bob are transmitting steganographic messages to each other. The way to achieve 
this is for the message to look "innocent" to Eve. Alice must be smart in applying the 
errors to the codewords and fool Eve into believing that the errors on the codewords 
are the result of an actual noise model on the quantum channel. One of our major 
contributions to this theory is the notion of the security of a steganographic protocol 
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Figure 4.1: There are three different inputs to the steganographic encoder £ : a cover- 
message |C); the secret message that we would like to hide, which can be quantum \S) 
or classical S; a shared secret key which may be quantum (ebit) \JC) or classical K,. Eve 
can monitor some part of the noisy quantum channel M shown in the red box. Bob can 
decode the steganographic message using the decoder V and the shared secret key |/C) 
or fC and recover |C), and IS) or S with very high probability. 



Hidden Message 


Key 


Code 


Classical 


Bit-string 


CQECC 


Classical 


E-bit 


EAQECC 


Quantum 


Bit-string 


QECC 


Quantum 


E-bit 


EAQECC 



Table 4.1: The first column represents message classical/quantum that we intend to 
hide. The second column represents the shared secret key between Alice and Bob. 
The third column represents the quantum error-correcting code. Here CQECC stands 
for Classically-Enhanced Quantum Error-Correcting Code; QECC stands for Quantum 
Error-Correcting Code and EAQECC stands for Entanglement- Assisted Quantum Error- 
Correcting Code 



which we elaborate in Chapter [5] by exploiting the properties of the diamond norm. 
We emphasize that a steganographic protocol is considered broken if Eve detects the 
presence of any sort of covert activity on the channel. 



Figure 4.1 gives a schematic description of a general steganographic protocol between 
Alice and Bob, who share a secret key K, which may be classical or quantum (an ebit). 



Table 4.1 shows the various scenarios of how one can hide a secret message in quantum 



codewords by using appropriate quantum error-correcting codes. 
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We organize the current chapter by first presenting a classical model of steganography 
by detailing two protocols that Alice uses to transmit steganographic information to Bob. 



In Section 4.2 we give two examples of how Alice uses the syndromes of an error-correcting 



code to optimize the transmission of steganographic bits over a binary symmetric channel 



with bit-flip error-rate p. In Section 4.3 we take a coding-theoretic approach to the 
problem. Instead of encoding her steganographic data into the syndromes of an error- 
correcting code, Alice encodes her information into the codewords themselves using two 
different error-correcting codes which we refer to as the "outer" and "inner" codes. The 
former is used as a cover-data, while we use the latter to encode steganographic bits. We 
give numerical results on the optimal number of bits that Alice can send to Bob with 
the syndrome encoding using the three-bit and five-bit repetition codes over a noiseless 
binary-symmetric channel. We also give numerical results when the BSC has noise for 
the three-bit repetition code. We were unable to extend this to the five-bit code because 
the analysis became complicated and there were too many variables to optimize over. We 
give numerical evidence of the optimal number of steganographic bits that Alice sends 
to Bob using the inner-outer coding technique. We end the chapter with concluding 
remarks before proceeding to detail quantum steganography. 



4.2 Syndrome Encoding 



How do I work? I grope. 
— Albert Einstein 



We begin with a very simple example of a classical steganographic protocol where Alice 
would like to hide a single bit of information, called a steganographic bit, in the syn- 
dromes of a classical error-correcting code. Alice and Bob a priori decide on a particular 
code. After encoding her information by disguising them as errors, she uses a noiseless 
binary symmetric-channel (BSC) to send the information to Bob. For this example let 
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us assume that they are using the [3,1,3] repetition code that encodes three physical bits 
into one logical bit, and can correct up to a single bit-flip error. Here n = 3, k = 1, and 
the distance d = 3. This code can correct a single bit-flip error. The codewords for this 
code are straightforward. 



= 000 , (4.1) 
T= 111 . (4.2) 

The number of syndromes for this code are 2 n ~ k = 2 2 = 4. We label the syndromes 
so, • • • , S3, where the first syndrome sq always corresponds to no error on the codeword. 
The rest of the syndromes s%, S2, and S3 correspond to single bit-flips on each of the three 
physical bits of the codeword. We need a natural error model for the bit-flip channel. 
We assume that single bit-flips occur with probability p independently of each other. 
The probability of no bit-flip is (1 — p), while as the probability of a bit-flip error is 
p. There is no intrinsic noise in the channel. The point of this protocol is for Alice to 
emulate a realistic noise model for the bit-flip channel and fool Eve into thinking the 
noise is actually coming from the environment or is due to the physics of the channel. 
Later we will analyze the case where there is also intrinsic noise in the channel. We give 



the channel probability distribution in Table 4.2. Notice that for each of the transformed 



codewords we give a sum of the probabilities of correctable and uncorrectable errors. For 



example if we observe the first row of Table 4.2 we see that we can obtain the codeword 
in two different ways - when there is no error on 000, which gives the probability (1 — p) 3 , 
and when the codeword 111 is flipped to 000 by three independent errors on each of the 
three physical bits. The probability of the latter occurring is p 3 . Similar reasoning gives 
us the total probabilities for the rest of the rows in Table |4~2) Alice and Bob have access 
to a shared binary string (the secret key) with a uniform probability distribution. They 
also have a function that takes as input shared secret bits from this key, and outputs an 
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Error 


Corrupted Codeword 


Syndrome 


Probability of Error 


Probability 


No Error 


000 


so 


(1 -pf + p 3 


Po 


Error on bit 1 


001 


Sl 


p(l -p) 2 +p 2 {l -p) 


Pi 


Error on bit 2 


010 


Si 


p(l — p) 2 +p 2 (l — p) 


P2 


Error on bit 3 


100 


S3 


p(l — p) 2 +p 2 (l — p) 


P3 



Table 4.2: Channel model for the [3,1,3] repetition code 



ordered pair (j,k) where j, k £ {0,1,2,3} with a non-uniform probability distribution, 
qjk- The ordered pair (j,k) provides both parties with the following map: 

Sj , (4.3) 

(4.4) 



If Alice wants to transmit a steganographic bit (say the bit 0), she applies the single- 
bit error corresponding to syndrome Sj with probability qjk, or Sk with probability q^j. 
When Bob gets the codeword, he knows how to decode the syndromes because he has 



access to the same mapping (4.3) that Alice does. 

As an example, imagine that Alice and Bob have access to a shared secret key and a 
function which they use to generate, say, the ordered pair (1,0) with probability gio- If 
Alice wants to hide the bit 0, she applies a single bit-flip error to the least-significant-bit 
(LSB) of her codeword, (or two bit-flips to the second and third bits of her codeword) 
and transmits it to Bob. This corresponds to syndrome s\. If she wants to send the 
bit 1, then she does nothing to her codeword, which corresponds to the syndrome sq. 
(Of course, Alice could have picked the reverse map as well with probability goij where 
she would have hidden bit in syndrome sq and bit 1 in syndrome s±.) The point 
of steganography is not to apprise Eve that Alice is sending steganographic bits to Bob 
over codewords. Imagine the scenario where Alice sends several single-bit steganographic 
messages to Bob. It would be a disaster if she kept using the same syndromes for her 
steganographic bits. After a few rounds Eve would immediately guess that the channel 
was being used to send steganographic messages, for each time Eve would just see either 
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no error or error on the first bit. This would be a very unnatural error model for the 
bit-flip channel. So Alice has to apply errors in such as a way as to emulate a natural 
error model. In applying errors she must match the probability distribution detailed in 



Table 4.2 This amounts to finding a solution to the following system of linear equations: 



« 2 



1 3 

^J2(Qjk + qkj), (4.5) 



fc=0 



where j,k 6 {0,1,2,3}. If the probability p of an error is very low, then Alice will 
not be able to hide information without apprising Eve because the Shannon entropy 



of the channel will be very low. For the probability distribution given in Table 4.2 
the maximum entropy H{p) = 2 is achieved when p = 1/2. Therefore, this is not a 
good code to send steganographic information to Bob, because most of the time Eve 
will be expecting no errors on the codewords. So Alice can only occasionally transmit a 
steganographic bit in a codeword in order not to alert Eve to any covert activity on the 
channel. 

Alice and Bob get around this problem by including the possibility that they will send 
no bit in a given code-block. This is represented by the diagonal elements qjj. In this 
case Alice just applies the syndrome Sj, and sends the codeword (with no steganographic 
bit) to Bob. Since Bob shares the secret key, he knows when to expect a steganographic 
bit. 

How should Alice choose qjk and qkj in order to emulate the probability distribution 



on the channel? We proceed with the solution to Equation 4.5 as follows. We first set all 



the diagonal terms except qoo to zero: i.e., qn = 522 = 933 = 0. We do this to maximize 



the probability of sending a steganographic bit. Now we expand Equation (4.5 ) for j = 1, 
to get the following: 

If 

pi = - {qw + Qn + qn + qi3 + qoi + qn + q%i + 931 

p(l - pf + p 2 {l - p) = ^ (qio + qu + qu + qoi + <?2i + <?3i^ • (4.6) 
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A solution to the above equation can be: 



910 = Q12 = 913 = 901 = 921 = 931 



p(l - p) 2 +p 2 (l - p) 



(4.7) 



The above solution gives Alice a better chance of sending a steganographic bit without 
apprising Eve, because Alice is spreading the likelihood of transmitting a steganographic 
bit among different syndromes. So there is a good chance of applying a different error 
each time that Alice sends a steganographic bit to Bob, and moreover, the probability 
of applying this error matches the expected distribution on the channel. The solution 
for pi and pz can be worked out similarly: 



920 — 921 — 923 — 902 — 912 — 932 



930 — 931 — 932 — 903 — 913 — 923 



p{\ -p) 2 +p 2 (l -p) 
3 

p{\ -p) 2 +p 2 (l -p) 



(4.8) 
(4.9) 



Now we go back and find the value for goo by solving Equation (4.5). For j = this 
corresponds to: 



[l-p) +p = - { 900 + 9oi + 902 + 903 + 9oo + 9io + 920 + 930 ] • 



(4.10) 



We already have the values for each of the terms in Equation (4.10) except goo- We, 
therefore, can solve for goo : 

' 900 = 4p 2 - 4p + 1 1 (4.11) 



We would like the probability of sending no steganographic bits to be as low as possible 
and so we would like goo to be as low as possible. The average steganographic information 
N avg that Alice transmits to Bob is the sum of the non-diagonal q-terms: 
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avg 



901 + 902 + 903 + 910 + 912 + 913 + 920 + 921 + 923 + 930 + 931 + 932 
p(l -p) 2 + p 2 {l -p) 



(4.12) 



4(p(l-p) 2 +p 2 (l-p)) , 



We now proceed to give a more efficient solution to Equation (4.5). As in the previous 



solution we would like to make goo as small as possible. So let goi, 9o2 ; 903) 9io> 920; and 
530 be non-zero and let all other q-terms be equal to zero. In order to solve for qoo, we 
must solve: 

i / JL / \\ 

(4.13) 



Po = \ (qoo + 9oo + + Ho) ) • 



Equation (4.13) can be simplified as follows: 



1 

Po = 900 + Y 2 1 qoj + Qj0 
3=1 



(4.14) 



We need the quantity within the sum in Equation (4.14) in order to find goo- We set 



all the non-zero q-terms goi, 9o2j 903; 9i0j 920> and (730 equal to the probability of a single 
bit-flip error, p 2 {l — p) + {1 — p) 2 p, as follows, 



Pi = 2 I qoj + qj0 



90j 



p 2 {l-p) + {l-p?p , 
9j0 =P 2 (1 ~P) + (1 -pfp , 



(4.15) 
(4.16) 



for j = 1,2,3. Substituting Equation (4.16) into Equation (4.14) we obtain: 



9oo = 6p 2 - 6p + 1 



(4.17) 
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Since the Shannon entropy for this channel is very low, p < 1, most of the time the 
codewords will go uncorrupted through the channel. We know that Eve is expecting to 
see this behavior on the channel. Any large deviation from this expectation will apprise 
Eve. So Alice takes advantage of this knowledge and uses the syndrome sq as often as 
she can in order to hide single bits. 

We can calculate the average amount of information that Alice transmits to Bob: 

N a vg = ^ ^ Qjk j 

= 901 + 902 + 903 + 910 + 912 + 913 + 920 + 921 + 923 + 930 + 931 + 932 , 

= Q(p\1-p) + (1-p) 2 p) , 

= 6p(l -p) . (4.18) 

Comparing with the first example, we can see that Alice is able to send more stegano- 
graphic information in the latter example because she is utilizing the syndrome sq which 



corresponds to no error on the codeword. This is evident from Figure 4.2 When she 
hides one bit in this syndrome, she's able to do more because most of the time Eve expects 
this channel to not corrupt the codewords and so Eve will be expecting codewords 000 
or 111. Alice knows this and thus takes advantage by packing in more steganographic 
information. 

4.2.1 Noisy Bit-Flip Channel 

We now investigate the case where Alice would like to transmit a steganographic bit to 
Bob in the presence of extra bit-flip noise on the channel. In this example, as opposed 
to the previous noiseless case, when Alice sends her codewords through the channel, the 
channel may flip a bit and change the syndrome that corresponds to a steganographic 



bit. As in the noiseless example in Section 4.2 Alice and Bob have access to a shared 



binary string and a generating function which inputs some of these key bits and outputs 
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Figure 4.2: Average Number of Steganographic Bits vs. Error-Rate p 

an ordered pair (j,k) with a non- uniform probability distribution q^. Alice and Bob 
both have access to the following map: 

sj , (4.19) 
l->s k . (4.20) 

If Alice wants to hide the bit 0, she applies the error corresponding to syndrome Sj on 



her codeword with probability qjk- Unlike the example in Section 4.2, now when the 



codeword passes through the channel there is a non-zero probability that the channel 
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will apply its own error to the corrupted codeword that Alice is transmitting. This gives 
rise to the following map: 



Sj -> si , (4.21) 
s k -> sj' • (4.22) 

There is a non-zero conditional probability p(l\j) and p(l\k) with which the channel 
transforms Alice's intended syndrome Sj (if she's hiding bit 0) or Sf. (if she's hiding bit 
1) to si, respectively. Alice would like to simulate this binary symmetric channel which 
now has additional noise from the environment. In order to achieve this, we would have 
to solve the following set of equations: 

Pi = \ E 9jk(p(l\j)+Pm) , (4-23) 
j,k=o v J 

where I = 0, 1, ... ,3. p' > p is the error rate of the effective channel. The effective 
probability distribution, corresponding to no flip, and bit-flips on bits one, two, and 
three of the noisy channel may be written as: 

p' = p'3 + (l- p ') 3 , (4.24) 
P'l = P2=P3=P(1-P) 2 +P\1-P)=P(1-P) • (4-25) 



As in the example in Section 4.2, we would like to determine the probability goo 
which corresponds to Alice not sending any bit to Bob. Our goal is to minimize this 
probability, because we want Alice to transmit steganographic bits to Bob. We begin 



by rewriting Equation (4.23) for I = 0. Note that we do not include diagonal q-terms 
(except qoo) in the following equation, as that corresponds to sending no steganographic 
bit. 

3 

Po = \ E m(p(P\fi +P(°\ k )) ■ (4-26) 
j,k=0 v J 
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Conditional Probability 


Corrupted Codeword 


Probability of Error 


p(0|0) 


111 yvy 

ooo 4 000 + 111 4 ooo 


(1 -p) 3 + p 3 = p 


p(0|l) 


Try yy r 

ooi — k ooo + no 4 ooo 


p(l - p) 2 + p 2 (l -p) = p\ 


p(0|2) 


oio 4 ooo + 101 -4 ooo 


p(l - p) 2 + p 2 (l -p) = p\ 


p(0|3) 


ioo ^ ooo + on 7 4 x ooo 


p(l -p) 2 +p 2 (l -p)=Pi 



Table 4.3: Conditional Probabilities - [3,1,3] Repetition Code 



After expanding Equation (4.26), we obtain the following equation: 



Po 



\ [qoo M0|0) + p(0|0)) + . . . + q 32 (p(0|3) + p(0\2] 



(4.27) 



In order to solve Equation (4.27), we need to determine the conditional probabilities, 



p(0|0),p(0|l),p(0|2), and p(0|3) which we have calculated in Table 4.3 After substitut 



ing the value of the conditional probabilities from Table 4.3 into Equation (4.27) and 
rearranging the terms, we get the following: 



p'n 1 (po + Pi ) / \ Pi 

qoo = — o qoi+qo2+qo3+qio+q2o+q3o — ( qi2+qi3+q2i+q23+qsi+q32 ) ■ 

Po 2 po V J Po 

(4.28) 



In order to solve Equation (4.28), we need to determine the values for the various q-terms. 



We begin by expanding the following equation: 

3 3 

lj2J2mp(i\j)+pm 



pi 



pi 



j=l k=0 



qio p(l|l)+p(l|0) +... + g 32 p(l|3)+p(l|2) 



(4.29) 



We determine the conditional probabilities appearing in Equation (4.29) in the same 



way as in Table 4.3 After calculating and substituting the values for the conditional 



probabilities into Equation (4.29) we get the following: 



Pi = o (P° + Pi) (^10 + Q12 + Qi3 + q2i + 931 ) + Pl(<720 + 923 + 930 + 932) • (4.30) 
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From Equation (4.30), we can easily set the q-terms to the following: 



qio = qi2 = 913 = 921 = 931 



1 Pi 
5 (po+Pi) 



920 — 923 — 930 — 932 



IK 

8 pi 



(4.31) 
(4.32) 



We still need to determine the values for <?oi>9o2, arid (/03. We begin by writing the 
following equation: 

1 3 3 / \ 

" ' ' (4.33) 



3 3 

P2 = ^EE?i*(p(2|i)+K2|fe)) • 

7=0 k=l ^ ' 



After expanding Equation (4.33), and rewriting, we get the following equation: 



Pi (901+903) + ^ (pO+PlW =P2-^(P0+Pl)( 9l2 + 921+92:', + </32 ) ~ Pi ( 9.1 3 + <l3 I > • ( '-'J I) 



But we already know the values of all the q-terms that appear on the right side of 



Equation (4.34). We substitute the values of these q-terms from Equation (4.31): 



1/ \ i 1 ( \/2 p lp'A /2 pi 

Pl901 + X PO+Pl 902+P1903 =P2~~ [PO+Pl 77 , 7 + 7,— ~Pl 7-7 , I • 

2\ / 2 V /V 5 (Po+Pi) 4piy V 5 (Po+Pi/ 

(4.35) 



Let us rewrite Equation (4.35) as follows: 



P2 = Pi 9oi + ~ ^Po + Pl^ 902 + Pi 903 + 7 , 



(4.36) 



where 



1 j_ \( 2 Px 

7 = o Po + Pi 



2 V' v ' 1 V V 5 (po + pi) 4 Piy v 5 (po + pi 

Now it is quite easy to set the values for goi> 902, and go3- 



(4.37) 



9oi = 903 = 3~IP2 " ~ 



1 

3pi 



Pi -7 



902 



2 p' 2 -7 = 2 pj - 7 
3 po + pi 3 po + pi 



(4.38) 
(4.39) 
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We can now finally substitute the values of the q-terms into Equation (4.28): 



n — P 1 
900-^- 5 



El _ 2 / P i -7 
Pi 3 I pi M P0+P1 



where 



a 



1 f Po + Pi 



2\ Po 
Pi 

Po ' 



(4.40) 



(4.41) 
(4.42) 



and where we obtain p' Q and p' x in terms of p and bp by expanding Equation (4.24): 



p' = 1 - 3p(l - p) - 35p(l - 2p) , 

Pi = P2 = P3 = p(l - p - 5p) + Sp(l - p) . 



(4.43) 
(4.44) 



Next we would like to determine the amount of average information that Alice can 
transmit to Bob if the effective error rate p' = p + 5p > p. The sum of the non-diagonal 
q-terms will give us the average information: 



N, 



"•■9 — Qjk ■ 



After expanding Equation (4.45), we get: 



N — 2(rJ — nAl PQ+ 2 Pi 
l\avg- 3 (Pi 7J^ pi (p 0+pi ) 



+ Pl 



Po+3pi 
2pi(po+pi) 



4.2.2 Numerical Simulation 



(4.45) 



(4.46) 



We would like to optimize the average number of bits that Alice can hide in a three- 
bit repetition code for both the noiseless and the noisy bit-flip channel. In order to do 
this we set up the problem as a linear-optimization one, where the objective function 
(also known as the cost or profit function) that we would like to optimize is the average 
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number of steganographic bits that Alice can transmit to Bob. We would further like to 
extend this example to the five-bit repetition code that encodes one logical bit into five 
physical bits, and can correct up to two arbitrary bit-flips. While we can implement the 



three-bit repetition code from Section 4.2 it turns out that if we extend this naively to 
the five-bit case, we run into the problem of optimizing over several thousand variables. 
This happens because unlike the three-bit case, the five-bit code has sixteen syndromes. 
This gives Alice and Bob many ways to encode their steganographic bits. With the 
three-bit code Alice and Bob can in addition to hiding a single bit, hide two bits. They 
would use the following encoding map: 

00 -> s , (4.47) 

01 -»• si , (4.48) 

10 -> s 2 , (4.49) 

11 -> s 3 . (4.50) 



However, if the error-rate of the channel is very low, then Alice will rarely transmit 
two steganographic bits. On the average Alice will transmit one steganographic bit to 
Bob. If Eve knows that the error-rate of the channel is low, where a single bit is flipped 
occasionally, she would be apprised of covert activity on the channel if Alice applies the 
two-bit encoding most of the time. The ideal situation for Alice would be where she 
minimizes sending no bit at all through the channel, but where she can occasionally 
(rarely) hide two bits, thereby boosting her transmission rate to little over one bit over 
several uses of the channel. The latter depends on the value of p. We summarize the 
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linear equality /inequality constraints along with the objective function N avg (average 
number of hidden bits) that we optimize, below: 

1 3 

Pj = 2 + ( 4 - 51 ) 

fc=0 

J^Qjk = 1, (4.52) 

j,k 

q jk > 0,Vj,k, (4.53) 
N aV g = + 2 ^ q jklm . (4.54) 

So we end up with five linear equality constraints and sixteen linear inequality con- 




ERROR-RATE 



p = 0.1 A k- p = 0.2 A k 


p = 0.3 A k — 


p = 0.4 A k 


— p = 0.5 A k 


- p = 0.7 A k p = 0.8 A k — 


p = 0.9 A k 


Shannon Entropy 





Figure 4.3: Noiseless Three-Bit Code. We plot the error-rate on the X-axis and the 
average number of bits, N avg , on the Y-axis for various error sequences. Here k varies 
from 1 to 100. As the error-rate increases Alice can hide up to two bits. The red curve 
plots the Shannon entropy of the probability distribution of the syndromes. 
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straints. We can already see that with the three-bit code we are optimizing over sixteen 
different variables, with several linear constraints. When we try to extend this naive 
approach to the five-bit problem, we end up optimizing over several thousand variables 
as we mentioned earlier. 

In the previous approach Alice and Bob use the sixteen variables qjk to keep track of 
the various ways in which they can encode their steganographic bits. We also know that 
Alice must apply errors in such a way that she matches the probability distribution p of 
the bit-flip channel. In the second approach Alice groups her syndromes by probabilities. 



From Table 4.2 it is clear that syndromes s\,S2, and S3 have the same probability p 2 (l — 
p) +p(l —p) 2 , while syndrome sq has the probability p 3 + (1 — p) 3 . We reduce the number 
of variables over which we must optimize by introducing the notion of a syndrome class. 
Instead of the variables qjk, we now use Qj 0i ...j M _ 1 , where jo is the number of syndromes 
Alice uses from the first group, and the number of syndromes she uses from the second 
group and so on, and where M = 2, tells us the total number of syndrome classes. So 
the Q variables give us the total probability of using an encoding scheme to hide a bit. 
Moreover, we use the variables rto,ni, ...,um-i to denote the various syndrome classes, 
and to keep track of the total number of syndromes in each group. So for the three- 
bit case we have no = 1 for we only have the syndrome sq, and n% = 3 for we have 
three different syndromes si,S2> and S3. With this new definition the linear equality 
constraints that Alice must now satisfy are as follows: 

Pk= Yl a _i_ a j + U \; Qjoh-jM-i , ( 4 -55) 

n A A JO + Jl + • • • +JM-1 

and 

E 2^1,..,^-! = 1 • (4-56) 
oo,h,— Jm-i 

While as the linear inequality constraints that she must satisfy are: 

j,, • > • (4.57) 
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The average number of bits that she can hide without apprising Eve of steganographic 
activity are: 



Navg = Yl L lo S2(i0 + jl + • • • + 3M-l)\ Qjoh-JM-X • ( 4 - 58 ) 



With the above definition we can frame our noiseless three-bit linear optimization prob- 
lem as follows: 



Po = Qio + \Qn + \Qi3 , (4.59) 

Pi = \ Qoi + I Qn + I Q02 + - Q13 , (4.60) 
o o 4 



E = 1 , (4-61) 
Qioji >0 , Vio,Ji , (4.62) 
iV = Q n + Q 02 + 2Qi 3 • (4.63) 

We have reduced our problem from optimizing over sixteen variables to optimizing over 
five variables. We summarize our result from this optimization in Figure |4.3[ In this 
example Alice can hide a maximum of two bits at an error-rate of 0.5. We plot the 
Shannon entropy of the various syndrome probabilities in red. In the limit of large block 
codes, we can essentially close the gap between the Shannon curve and the curves for 
the optimal solution. 

We now detail the five-bit code, [5,1,5] example. This is a distance-five code and 
can correct up to two bit-flip errors. The [5,1,5] code has sixteen distinct syndromes, 
so, s±, . . . , S15. As in the previous example, so corresponds to no error. Syndromes 
si, S2, ■ ■ ■ , s§ correspond to single bit-flip errors on each of the five physical bits of the 
corrupted codeword. Syndromes sq, S7, . . . , S15 correspond to double bit-flip errors. We 



summarize the error model for the bit-flip channel for the [5,1,5] code in Table 4.4 



Notice that as in Table 4.2 we have included the probabilities for both correctable and 



uncorrectable errors in each of the rows of Table 4.4 In the five-bit example we have 
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Table 4.4: Channel model for the [5,1,5] code 



three distinct syndrome classes, no error, a single bit-flip error, and two bit-flip errors. 



we sec 



We label these classes by no,rii, and 112 respectively. If we observe Table |4~4 
that no = l,«i = 5, and ri2 = 10. The probability of using a particular encoding is 
represented by the variable Qj j 1 j 2 - With the five-bit code, Alice can hide up to four 
steganographic bits. We summarize the various encoding schemes that Alice can employ 



to send zero, one, two, three, and four bits to Bob in Table 4.5 The first linear equality 
that Alice must satisfy is that the total probability of using all the various encoding 
schemes must sum up to 1: 

E Qjohh = 1 • (4-64) 
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The second set of linear equality constraints deals with satisfying the probability distri- 
bution of the channel, as follows: 

Po = Qioo + ^ ^Qno + Qioi^ + | ^Qi3o + Qui + Q103 + Qm^ 

' ^Ql52 + Ql43 + Ql34 + Ql25 + Qll6 + Ql07^) + ^Ql.5,10 , (4-65) 

Pi = ^Qoio + Q020 + Qo4o^ + ^ ^Qno + Q011 + Q121 + Q022 + Q044 + Ql43 

+ 20 (^ 130 + ^ 031 ^) + g ^152 + Qo53^ + ^Qo35 + Ql34^ 

+ 7^7 (Soi3 + Q026 + Ql25 + Qll2^ + ^ (^Qoi7 + Qlie) + ^Ql.5,10 , (4-66) 

P2 = 10 (^° 01 + ^° 04 + ^ 008 + ^002^ + 7777 ^Qo53 + Ql43^ 
+ 7^7 f Qoil + Qwi + Q022 + Q044 + Q112) + 7^ (OoVI + Ql07 
+ |7j ^2l21 + Qo31 + Ql52^ + ^77 ^2oi3 + Qo26 + Qll6 + Ql03 
+ ^ (Q035 + Ql25 + Qi, 5 ,io) • (4.67) 

The linear inequality constraints that Alice must satisfy are: 

Qjohj 2 > 0, Vjo , ji , 32 • (4.68) 

The objective function that Alice must maximize is the average number of steganographic 
bits that she can transmit to Bob: 

Navg = ^2 Qjojih + ^Qjojij2 

i0+jr'l+i2=2 j'0+jr'l+jr'2=4 

+ E 3Q :>onn + E 4Q johh ■ (4-69) 

j0+ii+i 2 =8 i0+ji+j 2 =16 
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Table 4.5: N s is the number of steganographic bits that Alice can hide and subsequently 
transmit to Bob. Column 2 shows the various encoding schemes that Alice can employ 
to successfully transmit steganographic bits to Bob. 



The result of optimizing the five-bit code is shown in Figure 4.4. The figure is 
qualitatively similar to the noiseless three-bit example. Once again the maximum number 
of steganographic bits that Alice can hide is at an error-rate of 0.5. This happens because 
at that rate the Shannon entropy of the channel is maximized which means that almost 
all of the codewords are experiencing bit-flips, and so Alice can on the average can 
transmit more steganographic bits. In the limit of large code-blocks, the number of 
steganographic bits that Alice can transmit to Bob reaches the Shannon capacity. Even 
though we don't prove this statement, one can infer this by eye-balling the gap between 



the steganographic curves and the Shannon curve in Figures 4.3 and 4.4. We now move 
on to the case where Alice hides up to two steganographic bits in a three-bit code and 
transmits it through a noisy bit-flip channel with error-rate p' = p + 5p, where bp > is 
the noise that the channel experiences from the environment, and where p is the error- 
rate that Eve expects of the channel. The idea here is that Alice ought to be able to 
utilize the extra noise in the channel to send a steganographic bit to Bob more frequently. 
We implement this linear optimization problem in terms of encoding classes following 



along the lines of noiseless three-bit example stated previously. In Table 4.6 we show the 

75 



ERROR-RATE 



p = 0.1 A k 


p = 0.2 A k 


P = 


0.3 A k p = 0.4 A k — p = 0.5 A k p = 0.6 A k 


— p = 0.7 A k 


p = 0.8 A k 


P = 


0.9 A k Shannon Entropy 



Figure 4.4: Noiseless Five-Bit Code. We plot the error-rate on the X-axis and the average 
number of bits, N avg , on the Y-axis for various error sequences. Here k varies from 1 to 
100. As the error-rate increases Alice can hide up to six bits. The red curve plots the 
Shannon entropy of the probability distribution of the syndromes. 

number of correct steganographic bits that Bob receives from Alice, when she encodes two 
steganographic bits in the three-bit code. Suppose Alice and Bob agree on a particular 



encoding, say, (j,k) with probability qjk, the encoding that we state in Equation (4.3). 
One can divide this scenario into two cases: the first case where Alice transmits the 
codeword corresponding to syndrome j, and Bob receives the codeword corresponding 
to syndrome I, and the second case where Alice sends the codeword corresponding to 
syndrome k, but Bob receives the codeword corresponding to syndrome I. Based on 
these two notions we define the probability of receiving a correct bit by Bob as follows: 

Pcorr(j, k) = \( E + E PW)) ■ ( 4 - 7 °) 

K p(l\j)>p(l\k) p(l\j)<p(l\k) ' 
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Figure 4.5: Noisy Three-Bit Code. We plot the channel noise bp on the X-axis and 
the average number of bits correctly received by Bob, N avg , on the Y-axis for various 
error-rates p which decrease by an order of magnitude. 

The linear equality and inequality constraints for the noisy example are exactly the same 



as those for the noiseless case in Equation (4.59). The objective function N avg that Alice 
must optimize is: 



N aV g = y^^Pcorrti, k)q jk + ^ 2 (p Q + p x ) q jk i m 
j^k jjLk^l^m 



(4.71) 



The above objective function, in the encoding classes setting, gets transformed to: 

N avg = po (Qn + Q 02 ) + 2( P0 +pi)Qi 3 • (4.72) 
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Table 4.6: The first column shows the two bits that Alice transmits to Bob, whereas the 
second column shows the received bits by Bob, some of which have experienced an error 
due to the noisy bit-flip channel. 

We expect that with the extra noise Alice ought to be able to sneak in steganographic 



bits more frequently, and that is what we our results show in Figure 4.5 



4.3 Inner-Outer Codes 



Information is the resolution of uncertainty. — Claude Shannon 



In this section we generalize the notion of transmitting steganographic bits over bit-flip 
channels by utilizing coding theory to our advantage. The strategy of straightforwardly 
encoding steganographic bits into the syndromes of an error-correcting code can only 
go so far. Transmitting steganographic bits over a five-bit code by utilizing syndromes 
becomes infeasible because the noisy environment can transform Alice's intended syn- 
drome to any of the other fifteen syndromes. The main reason that the strategy worked 
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for the three-bit case is because it is a very simple example, the conditional probabil- 
ities are easy to calculate, and there are not too many ways by which the noise can 
transform the syndromes of the three-bit code. In this chapter we present a different 
protocol for transmitting steganographic bits over a bit-flip channel. The protocol still 
uses error-correcting codes, but Alice and Bob no longer encode steganographic bits into 
syndromes. One of the main advantages of developing this protocol is that it generalizes 
in a straightforward fashion to the quantum setting. 

4.3.1 Classical Steganographic Protocol 

In any steganographic protocol the sender, Alice, embeds her steganographic information 
into an innocent-looking cover-text message, and transmits it to the receiver Bob over a 
binary symmetric channel with bit-flip rate p. She could for example use a passage from 
Hamlet to encode steganographic information into Shakespeare's poetry via a secret key 
shared between Bob and her. When this message is intercepted by Eve she does not 
suspect that there is any covert activity between them because, after all, the message is 
just a few passages from Hamlet. Our biggest challenge was to extend this latter notion of 
an innoncent-looking message to the information-theoretic setting. As we demonstrated 
in the previous chapter, we achieve this via a set linear equality constraints that Alice 
must satisfy so that she can match the probability distribution p of the bit-flip channel. 
The protocol begins as follows: 

(i) . Alice chooses an [N, k c ] error-correcting code, where N S> 1, as her cover-code. 

We also refer to this cover-code as an "outer" code. 

(ii) . Alice chooses a random M-bit subset from among the N bits of the outer code, 

where M < N, and M S> 1. The locations of these M bits is specified by the 
secret key that Alice and Bob share with each other. 

(iii) . Alice applies errors to the subset of M bits using an [M, k s ] code, which we refer to 

as the "inner" code, thereby encoding k s steganographic bits. An average codeword 
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of an [M, k s ] code has weight approximately By applying these errors on the 
JV-bit code-block, the effective binary symmetric channel has a bit-flip rate of 
am — 

1 ~ 2N' 

(iv) . For an extra layer of protection Alice applies a one-time pad to the M-bit subset. 

In addition to the original key, Alice and Bob also share these extra M bits of their 
one-time pad. 

(v) . Alice transmits her iV-bit code-block through the channel. 

(vi) . Bob measures the syndromes of the cover-code and extracts the pattern of bit-flip 

errors. 

(vii) . Bob reapplies the one-time pad to the M-bit subset and recovers the errors on the 

M bits. 

(viii) . Bob decodes the M-bit codeword and correctly recovers kg ste ganographic bits. 



Let us clarify the protocol above with a simple example which is shown in Figure 4.6 
Suppose Alice chooses the ten-bit repetition code, [10,1,10], as her cover-code. She 
encodes 1 into 1111111111 which is one of the codewords of the [10, 1, 10] code. So the 
[10, 1, 10] is her "outer" code. She then chooses three bits randomly from this ten-bit 
code-block. In this example she chooses the third, sixth, and eighth bits to represent 
the codeword for her [3,1,3] inner-code. She then flips the rest of the bits to 0. She 
ends up with 0010010100. Suppose the one-time pad is 0010000100. She then applies 
this one-time pad to 0010010100, and gets 0000010000. She finally encodes this into 



the cover-code by XORing the latter with 1111111111. She ends up with the bit-string 



111110ip .il which she then transmits through a binary-symmetric channel to Bob. Let 



us say that this bit-string experiences bit-flips on fourth and eighth bits. Bob receives the 



bit-string 110110 0111. Since he knows that Alice used the [10, 1, 10] code as her cover- 



code, he knows that to unmask the cover he needs to XOR with 1111111111, which he 
does and obtains the string 0010011000 to which he now applies the one-time pad to 
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Table 4.7: Encoding for transmitting one steganographic bit over a bit-flip channel with 
[3, 1, 3] as an inner-code and [N, 1, N] as the outer code. 

recover 0000011100. He now uses the shared secret key in order to determine the bit 
locations of the inner [3, 1,3] code. He knows that the three-bit code comprises of the 
third, sixth, and eighth bits. So he recovers the bit-string 011, to which he applies error- 
correction and obtains 111, which he correctly decodes as 1. If the channel had flipped 
two bits of the inner code, then Bob would have incorrectly decoded the steganographic 
bit. Alice can avoid this problem by using a bigger code for her inner-code block. In 
this example had she used the [5, 1, 5] code as her inner-code, then Bob would have been 
able to correct for up to two errors. Moving to larger block codes unfortunately leads to 
a decrease in the transmission rate. 



4.3.2 Three Bits In N Bits Encoding 

We now give a specific example where Alice uses the [3,1,3] repetition code as her 
inner code, while using an iV-bit repetition code as her outer code. As in the previous 
chapter, we frame the problem as a linear-optimization one. We present the encoding 



in Table 4.7 We introduce the variable 3\?/c, which is the probability of choosing to 



hide steganographic bit i using the encoding bit j, and where we allow k bit-flips on the 



outer-code. So i refers to the first column of Table 4.7, while j, and k refer to the second 
and third columns, respectively. With probability Q Alice uses the encoding 3\jfc to 
transmit a steganographic bit, and with probability 1 — Q she sends no steganographic 



81 



bit to Bob. However, when she chooses to send no steganographic bit to Bob, she applies 
I errors randomly to the TV-bit code block with probability qi . Alice does this because in 
case the error-rate of the channel is small and she cannot hide no steganographic bit, she 
may as well fool Eve by applying random errors which would still match the probability 
distribution p of the channel. The set of linear equality constraints that she must satisfy 
are: 



Po = (^(1-^ = ^000 + 90, (4.73) 
Pi = (J^jpil-P)^ 1 =y io + y oi + qi , (4.74) 
P2 = (^V(! " P) N ~ 2 = ^oio + 3>ooi + 34)02 + <Z2 , (4.75) 



PN = { N JP =y W{ N-3)+qN ■ (4.76) 

We also insist that the steganographic bit that Alice chooses to transmit to Bob should 
be independent of her choice of encoding. To match the latter constraints Alice must 
satisfy: 

3>oo = 3>io , (4.77) 
3>oi = 3>n , (4.78) 



where 

N-3 



% = £ y ijk ■ (4-79) 



k=0 

In addition to the above equality constraints, we also want conservation of probabilities: 

ijk I 
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Alice must satisfy the following linear inequality constraints: 



y ijk >0,Vi,j,fc , (4.81) 
cft>0,VZ. (4.82) 

Alice wants to maximize the probability of transmitting a stegaongraphic bit to Bob 
with each use of the channel. So she must maximize the following objective function: 

N avg = y ^y ijk . (4.83) 

ijk 

We simulated the above protocol keeping the inner [3,1,3] code fixed, while using the 



outer code [N, 1, N] for N = 5, 7, 9, 11, 13, and 15. From Figure 4.7 it is clear that as we 
increase the length of the outer code block from N = 5 to N = 15, she can utilize more 
of the error-rate region in order to transmit a steganographic bit to Bob. In the next 
section we generalize this by allowing an arbitrary inner-code. 

4.3.3 M Bits In N Bits Encoding 

In this section we detail how Alice can transmit M steganographic bits to Bob over a 
noisless binary symmetric channel with a bit-flip rate of p. Once again we frame this 
problem as a linear optimization one, where we are optimizing over the average number 
of steganographic bits that Alice can transmit to Bob without apprising Eve of any 
suspicious activity — making the whole protocol look innoncent to Eve. Let Sm be the 
subset of the bits that comprise the inner-code. Let S = Sjy be the subset of the bits 
that comprise the outer [N, k c ] code. Let y^ be the probability of flipping i bits of Sm-, 
and j bits of Sn where < j < N — M. When Alice decides to send no steganographic 
bits to Bob she applies random bit-flips to her iV-block code with probability qi, where 
< I < N. Let Q = yij-> be the total probability of sending a M steganographic bits 
to Bob, and let 1 — Q = q r be the total probability of transmitting no steganographic 



S3 



bits to Bob. We would like to minimize the latter quantity or equivalently maximize Q. 
For this scheme to be useful Bob must be able to decode Alice's messages, which means 
that the outer code should be able to correct up to t s = [^-^J errors. 

The first set of linear equality constraints that Alice must satisfy is the probability 
distribution that must match the error-rate of the bit-flip channel. These are: 

Po = (Tj(l-P) N = y o + Qo , (4.84) 
Pi = (^jpil-p)^ 1 =yoi+yio + qi , (4.85) 

^2 = ( N \ 2 {i-p) N ~ 2 = y2o+yu+ym + q2 , (4.86) 



N\ N 



PN = \Nl P = ^ M ( N - M ) +qN ■ ( 487 ) 
The second set of linear equality constraints is on the bits that comprise the inner-code: 



34 2M 



1 /AT M N - M 



i=0 j=0 

where 

N-M 

y k = y ^ ■ ( 4 - 89 ) 
3=0 

Alice must also satisfy the following: 

ij I 

As in the previous optimization problems, Alice must satisfy the following linear inequal- 
ity constraints: 

3V,>0,Vi,j, (4.91) 
qi>0yi. (4.92) 
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Alice wishes to maximize the average number of steganographic bits that she can transmit 
to Bob. So the objective function is: 



From Figure 4.8 it is clear that the three-bit code outperforms both the five and seven 
bit codes initially, but is then outperformed by the higher bit codes when the channel 
bit-flip rate increases. One can also infer from the plot (though we have not proved this) 
that with increasing block-size the average number of steganographic bits will reach the 
Shannon capacity of the channel. 

The protocol above is for a bit-flip channel which has no intrinsic noise. The flips that 
Eve observes are artificially induced by Alice and are incorporated in such a way as to 
match with Eve's belief of the error-rate of the channel. For the inner-code above, Alice 
and Bob do not use an actual error-correcting code. However, if there is intrinsic noise in 
the channel due to the environment, then they must use an error-correcting code for their 
inner-bits. This could be an [M, k s ] code, where M <C N, and where now Alice instead 
of transmitting M bits to Bob, can only transmit k s bits. Clearly the transmission rate 
goes down, but that is the price Alice must pay for Bob to have any chance of decoding 
the message properly, and correctly acquiring the right steganographic bits. We now 
proceed to give an exact formula for the amount of secret key consumed in each round 
of the protocol as a function of p and the intrinsic noise Sp. 

4.3.4 Key Consumption Rate 

In this section we detail how many bits of the shared secret key Alice and Bob consume 
per block of code that Alice transmits to Bob. We define this quantity as the key- 
consumption rate ICp P . There are (^) ways of choosing M locations out of N in an N 
bit code-block. So the total number of bits that Alice and Bob need to specify the subset 
Sm which comprises the bits for the inner code is log f ^) . They also need M bits of key 



85 



for the one-time pad to encrypt their steganographic bits. So the total bit-length \K\ of 
the shared secret key is: 



l/vl MO -:-•<< 



(4.94) 



After applying Stirling's approximation to the right hand side of Equation (4.94), we get 
the following: 



\K\ ^ NlogN - M\ogM - (N - M)\og{N - M) + M . 



(4.95) 



Replace M in Equation (4.95) by M ~ 2Nq, where q is the rate at which Alice applies 



errors to the iV-bit code-block in order to emulate the actual probability distribution of 
the binary symmetric channel with bit-flip rate p. We get the following: 

|/C| « NlogN -2Nqlog(2Nq)- (N -2Nq)log(N -2Nq) + 2Nq 

~ N log N - 2Nq (log 2 + log N + log q)-N(l- 2q) log JV(1 - 2q) + 2Nq 

ps NlogN - 2Nq - 2NqlogN - 2Nqlogq 

- N(l-2q)\ogN - N{l-2q)log(l-2q)+2Nq . (4.96) 



Now collect all the logiV terms in Equation (4.96) 



i (N - 2Nq -N + 2Nq) log AT 

-2Nq - 2Nq\ogq- N\og{\ - 2q) + 2iVglog(l - 2q) + 2Nq 



(4.97) 
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The first term in Equation (4.97) is zero. Moreover the two 2Nq terms cancel each other. 



We proceed further with the simplification below: 



\K,\ 



2X<i ( log(l - 2q) - log q - i- log(l - 2q) 



2Nq I log(l - 2q) - log q - log(l - 2q) 
2Nq (log(l - 2q) - (\ogq + log(l - 2q)^ 
2Nq (log(l - 2q) - (logq{\ - 2q)^\\ 



2Nq[ log 



N\ 2q\og 



(1 ~ 2g) 

9(1-25)^ 
(1 - 2q) 



(4.98) 



9(1 -2q)*«. 

We want to express the key-consumption rate in terms of the error-rate p of the channel, 



and the extra noise 5p. We can substitute q = in Equation (4.98): 



\1C\ wiVl 



25p 
l-2p 



log 







(4.99) 



where 



l-2(p+5p) 
l-2p 



. So the key-consumption rate K, 



s P _ \jq 

" N 



is: 



ftp 



* log 



(5p 



(4.100) 



From Figure (4.9) one can see that as the error-rate increases Alice and Bob consume 



key at a faster rate. They need more bits to specify the subset Sm as Alice needs to flip 
more bits in order to emulate the additional noise. For a higher 5p our intuition tells us 
that Alice and Bob ought to use a longer key-length, as Alice would be choosing more 
bits to flip (on the average). 
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4.4 Concluding Remarks 

We presented two different protocols on how to hide classical bits by first encoding 
Alice's steganographic information into the syndromes of an error-correcting code and 
then later using the codewords themselves to encode the hidden information. Both 
techniques have their pros and cons. The syndrome encoding quickly fails if we try to 
determine the optimal number of stego bits that Alice would like to send to Bob. The 
second technique of encoding stego bits as codewords of an error-correcting code gives 
gives us a better handle on the steganographic rate and the rate of key consumption. 
While we have presented these two encodings for a finite sized code block, we would like 
to extend these ideas to the case where N is large. In Chapter[5]we present results on the 
steganographic rate using syndrome encoding in the asymptotic sense. We have pushed 
the asymptotic results to a later chapter because we need to introduce the notion of the 
diamond norm. We use this norm to define the security of our quantum steganographic 
protocols. Our main aim in constructing a model of classical steganography was to gain 
intuition on how we can extend our classical model to a quantum one. In the next 
chapter we present our formalism for quantum steganography. 
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Figure 4.6: Classical Steganographic Protocol. The protocol begins in the top half. 
Alice's steganographic bits are shown in red. The one-time pad is shown in as green 
discs. The bold dashed line shows that Alice and Bob are separated over space and Alice 
uses a BSC to transmit the codeword to Bob. The bits colored red comprise the inner 
[3,1,3] block code, and the blue discs comprise the [10,1,10] outer block code. The noisy 
channel flips the fourth and eighth bits. The shared key is used by Alice and Bob to 
specify the location of the steganographic bits and to generate the one-time pad. 
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Figure 4.7: Three Bits in N Bits Encoding. We plot the channel error-rate p on the 
X-axis and the average number of transmitted steganographic bits , N avg , on the Y-axis. 
Here M refers to the length of the inner code while N refers to the length of the entire 
block code. The curves in black show the Shannon entropy of the channel with the 
corresponding block code. 
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Figure 4.8: M Bits in N Bits Encoding. We plot the channel error-rate p on the X-axis 
and the average number of transmitted steganographic bits , N avg , on the Y-axis. Here 
M refers to the length of the inner code while N refers to the length of the entire block 
code. The black curve shows the Shannon entropy of the channel when N = 17 bits. 



91 




92 



Chapter 5 



Quantum Steganography 

Marvelous, what ideas the young people have these days. 

But I don't believe a word of it. 

— Albert Einstein 

In this chapter we introduce our formalism for quantum steganography. It was impor- 
tant to establish an intuition, a deep understanding of a classical model of steganography 
before we could proceed to cast the problem in its quantum form. Considering the num- 
ber of papers being published in quantum information science each day, it came as a 
surprise to us that only four papers had been published in this subject area! Before we 
present our protocols for quantum steganography, we provide a brief history of the work 
that has been done in quantum steganography by other researchers. 

Julio Gea-Banacloche introduced the idea of hiding secret messages in the form of 
error syndromes by deliberately applying correctable errors in a quantum state encoded 
using the three-bit repetition code, [[3, 1,3]] |2j. He also discussed the idea of "reverse 
encoding" to transmit a quantum steganographic message which is obtained by applying 
a superposition of bit-flip errors on the codeword of the three-bit code. If the receiver 
Bob knows exactly which error-correcting code was used to encode the quantum state 
he can read the hidden message in the error syndromes of the code. Eve can monitor 
the channel and can perform measurements to diagnose errors. The downside to this 
protocol is that if Eve knows the exact code that Alice and Bob are using then she can 
measure the codewords and undo the errors introduced by Alice and thereby transmit 
the wrong steganographic message to Bob. Gea-Banacloche suggested a way around this 
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problem by insisting that Alice and Bob share a secret bit. Alice uses this secret bit 
to encode her codewords in either of two mutually non-orthogonal bases. If Eve now 
proceeds to measure the codewords, she will be able to diagnose the correct errors only 
half of the time, and half of the time she will disturb the state of the codewords which 
Bob will be able to detect and thereby abort the protocol. One can strengthen this 
protocol by insisting Alice choose from a larger set of mutually non-orthogonal states 
rather than just two. In such a case Alice and Bob will have to share a longer secret key, 
instead of a single bit. One of the central notions in steganography is that a message 
should look innocent to Eve. We tackle this issue extensively in this thesis, but which 
Gea-Banacloche does not address in his paper. 

Curty et. al. propose three different quantum steganographic protocols [IS]- In the 
first protocol they hide bits or 1, by replacing a noisy qubit with |+) or |— ) respectively. 
In a modified protocol they hide two classical bits into a noisy qubit using super-dense 
coding. In a third protocol they teleport a steganographic qubit by communicating 
the classical bits that Bob needs over a classical steganographic channel in order to 
perform the correct measurement so that he can retrieve the qubit. They do not address 
the issue of an innocent message, or give key-consumption rates. Natori provides a 
very rudimentary treatment of quantum steganography which is once again just a slight 
modification of super-dense coding |37j . Martin introduced the notion of steganographic 
communication of quantum information in [35] . His protocol is a modification of Bennett 
and Brassard's quantum- key distribution protocol (QKD). He hides a steganographic 
channel in the QKD protocol. 

We can imagine a day when quantum networks become ubiquitous. Quantum 
steganography could provide a way to embed a stego message into some quantum data of 
interest which Alice could then send to Bob. Alice could use a few steganographic qubits 
located at random locations as a "watermark." Both of them could exploit quantum 
correlations such as entanglement between various steganographic qubits to determine 
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whether the quantum information was tampered by Eve as it passed through a quan- 
tum channel. An advantage that steganography has over standard encryption schemes 
is that while users or systems could be communicating over a network through steganog- 
raphy, this communication could go on for a very long time, completely undetected. 
In an encryption protocol this is not necessarily the case. Quantum steganography 
has far-reaching consequences, and it may give us a measure of security which classical 
steganography may not be able to parallel. 

We begin by showing how one can hide quantum information in the noise of a depo- 
larizing channel, using a shared classical secret key between Alice and Bob. In our first 
quantum steganographic protocol the channel is intrinsically noiseless (i.e., all noise is 
controlled by Alice), and in the second case the channel has its own intrinsic noise (not 
controlled by Alice and Bob). We calculate the amount of secret key consumed. We will 
later present a quantum steganographic protocol for general quantum channels. We will 
also look at the question of whether Alice and Bob can send a finite amount of hidden 
information, or can actually communicate at a nonzero asymptotic rate (given an arbi- 
trarily large secret key). This depends on Eve's knowledge of the physical channel, and 
Alice and Bob's knowledge of Eve's expectations. Finally we will address the question 
of security. This is two-fold: first, can Eve detect that a secret message has been sent, 
and second, can she read the message? 

5.1 The Depolarizing Channel 

The quantum analog of the classical binary symmetric channel (BSC) is the depolarizing 
channel (DC) which is one of the most widely used quantum channel models: 

p -> Np = (1 - p)p + P -XpX + P -YpY + P -ZpZ . (5.1) 
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That is, each qubit has an equal probability of undergoing an X, Y, or Z error. Applying 
this channel repeatedly to a qubit will map it eventually to the maximally mixed state 
1/2. We can rewrite this channel in a different but equivalent form: 

M = (1 - ip/3)J + (4p/3)T • (5.2) 



where J p = p and Tp = (1/4) (p + XpX + YpY + ZpZ). The operation 7" is twirling: it 
takes a qubit in any state p to the maximally mixed state 1/2. If we rewrite the channel 
in this way, instead of applying X, Y, or Z errors with probability p/3, we can think 
of removing the qubit with probability 4p/3, and replacing it with a maximally mixed 
state. This picture makes the steganographic protocol more transparent. We will first 
assume that the actual physical channel between Alice and Bob is noiseless. All the noise 
that Eve sees is due to deliberate errors that Alice applies to her codewords. 

(i). Alice encodes a covertext of k c qubits into N qubits with an [[N, k c ]] quantum 
error-correcting code (QECC). 



(ii) . From (5.2), the DC would maximally mix Q qubits with probability pq where 

PQ=(^)(4p/3) Q (l-4p/3) iV - ( 3. (5.3) 

For large N, Alice can send M = (4/3)piV(l — 5) stego qubits, where 1 > ^ > 
a/(1 - 4p/3)/(4p/3)N. (The chance of fewer than M errors is negligibly small.) 

(iii) . Using the shared random key (or shared ebits), Alice chooses a random subset 

of M qubits out of the N, and swaps her M stego qubits for those qubits of the 
codeword. She also replaces a random number m of qubits outside this subset 
with maximally mixed qubits, so that the total Q = M + m matches the binomial 



distribution (5.3) to high accuracy. 



(iv). Alice "twirls" her M stego qubits using 2M bits of secret key or 2M shared ebits. 
To each qubit she applies one of I, X, Y, or Z chosen at random, so p — > Tp. To 
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Figure 5.1: We plot the key consumption rate (KCR) as a function of the error-rate p 
of the channel. 



Eve, who does not have the key, these qubits appear maximally mixed. (Twirling 
can be thought of as the quantum equivalent of a one-time pad.) 

(v). Alice transmits the codeword to Bob. From the secret key, he knows the correct 
subset of M qubits, and the one-time pad to decode them. 



This protocol transmits (4/3)piV(l— <5) secret qubits from Alice to Bob 5.2 If the channel 
contains intrinsic noise, Alice will first have to encode her k s stego qubits in an [[M, k s ]] 
QECC, swap those M qubits for a random subset of M qubits in the codeword, and 
apply the twirling procedure. This twirling does not interfere with the error-correcting 
power of the QECC if Bob knows the key. Assuming the physical channel is also a 
DC with error rate p, and that Alice emulates a DC with error rate q, the effective 
channel will appear to Eve like a DC with error rate p + q(l — 4p/3) = p + 5p. The rate 
of transmission k s /N will depend on the rate of the QECC used to protect the stego 
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qubits. For a BSC this would be (1 — S)(l — h(p))6p/(l — 2p). However, for most quantum 
channels (including the DC) the achievable rate is not known. 

The secret key is used at two points in these protocols. First, in step 3 Alice chooses 
a random subset of M qubits out of the A-qubit codeword. There are C(A, M) subsets, 
so roughly log 2 C(A, M) bits are needed to choose one. Next, in step 4, 2M bits of key 
are used for twirling. This gives us 



N 

n k « log 2 | | +2M (5.4) 
M 



bits of secret key used. Define the key consumption rate K, = n^/N to be the number of 
bits of key consumed per qubit that Alice sends through the channel. We use M ~ 4qN/3 



and q « 5p/ (1 — 4p/3) to express JC in terms of p, 6p, and A 4.9 



K « log 2 [(4//3)^(l - PNf- 1 ] , p = 4^/(3 - 4p) . (5.5) 

Alice can consume fewer bits of key if Bob and she have access to a source that produces 
maximally mixed states. This would allow them to bypass the twirling procedure. The 
protocols given above perform well in emulating a depolarizing channel. However, there 
are far more general channels than these, and the protocols may not work well, or at all, 
in these cases. If one has a channel that can be written 



p — > Afp = (1 — pr + Pe)J P + PrTp + pe£r (5.6) 

where £ is an arbitrary error operation, one can still use the above protocols to hide 
approximately p^N stego bits or qubits, while generating pgiV random errors of type 
£. But for some channels, pr may be very small or zero. How should we proceed? 
Moreover, hiding stego qubits locally as apparently maximally-mixed qubits sacrifices 
some potential information. The location of the error — that is, the choice of the subset 
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holding the errors — could also be used to convey information, potentially increasing the 
rate and reducing the amount of secret key or shared entanglement required. 

A different approach is instead to encode information in the error syndromes. For 
simplicity, we consider the case when N is large. In this case, it suffices to consider only 
typical errors. We begin with the case where the physical channel is noise- free. 

For large N, almost all (in probability, 1 — e) combinations of errors on the individual 
qubits will correspond to one of the set of typical errors. There are roug hly 2 sN of these, 
and their probabilities p e are all bounded within a range 2~ N ( S+5 ^ < p e < 2~ JV ( S ~' 5 ). 
The number s is the entropy of the channel on one qubit; for the BSC s = h(p) = 
—plog 2 p — (1 — p) log 2 (l — p), and for the DC s = — (1 — p) log 2 (l — p) — plog 2 p/3. We 
label the typical error operators Eq, Ei, . . . , E 2 sn_i, and their corresponding probabilities 
are pj. A good choice of QECC for the cover text will be able to correct all these errors. 
We make the simplifying assumption that the QECC is nondegenerate, so each typical 
error Ej has a distinct error syndrome Sj. 

Ahead of time, Alice and Bob partition the typical errors into C roughly equiprobable 
sets Sk, so that 



As far as possible, the errors in a given set should be chosen to have roughly equal 
probabilities. The maximum of C is roughly C » 2 N ( S ~ S \ and k = 0, . . . , C - 1. We 
can now present a new quantum steganographic protocol, using error syndromes to store 
information. 

(i) . Alice prepares k c qubits of cover text in a state \ip c )- 

(ii) . Alice's secret message is a string of log 2 C « N(s — 5) qubits, in a state 




(5.7) 



E 



C-l 



|Y> S ) = ^ a k\k) ■ 



(5.8) 



k=0 
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She "twirls" each qubit of this string, using 2N(s—5) bits of the secret key or shared 
ebits, to get a maximally mixed state. To this, she appends N — k c — (s — 6)N 
extra ancilla qubits in the state |0) to make up a total register of N — k c qubits. 

(iii) . Using the shared secret key, Alice chooses from each set a typical error Ej k with 

syndrome Sj k . She applies a unitary Us to the register of N — k c qubits, that maps 
Us (\k) ® \ty® N ~ kc ~( s - s ) N ^ = \sj k ). She appends this register to the cover qubits 
in state \ip c ), then applies the encoding unitary Ue- Averaging over the secret key, 
the resulting state will appear to Eve like p « Y^^o" 1 PjEj\^c)(^c\Ej, which is 
effectively indistinguishable from the channel being emulated acting on the encoded 
cover text. 

(iv) . Alice sends this codeword to Bob. If Eve examines its syndrome, she will find a 

typical error for the channel being emulated. 

(v) . Bob applies the decoding unitary Up = U^, and then applies Ug (which he knows 

using the shared secret key). He discards the cover text and the last N—k c —(s—5)N 
ancilla qubits, and undoes the twirling operation on the remaining qubits, again 
using the secret key. If Eve has not measured the qubits, he will have recovered 
the state encoded by Alice. 

This protocol may easily be used to send classical information by using a single basis 



state rather than a superposition like (5.8). The steganographic transmission rate 1Z 



is roughly 1Z ~ s — 5 — > s. The rate of transmission s is higher than the rate 4p/3 of 
our first protocol. This protocol used 2N(s — 5) bits of secret key (or ebits) for twirling 
in step 2, and roughly N5 bits of secret key in choosing representative errors Ej. from 
each set in step 3. So the key rate is roughly K, ~ 2s — 5 — > 2s, better than the 
first protocol in key usage per stego qubit transmitted. However, this encoding is much 
trickier in the case where the channel contains intrinsic noise. 

In principle this quantum steganographic protocol can be used when the channel 
contains noise. The steganographic qubits are first encoded in a QECC to protect them 
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against the noise in the channel. In practice, for many channels this can be difficult: 
the effects of errors on the space of syndromes look quite different from a usual additive 
error channel. Also, unlike the depolarizing channel, general channels when composed 
together may change their type. However, by drawing on codes with suitable properties, 
the problem of designing steganographic protocols for general channels may be simplified. 
We discuss a simple example in the supporting online material (SOM), but the solution 
for a general channel is a problem for future work. 

What is the standard of security for a stego protocol? There are two obvious con- 
siderations. First, if Eve becomes suspicious, can she read the message? By the use of 
one-time pads or twirling, Alice and Bob can prevent this from happening. 

The more important question is, can Alice and Bob avoid arousing Eve's suspicions in 
the first place? In order to do this, the messages that Alice sends must emulate as closely 
as possible the channel that Eve expects. We can make this condition quantitative. Let 
£c be the channel on N qubits that Eve expects, and let £5 be the effective channel that 
Alice and Bob produce with their steganographic protocol. Then the protocol is secure 
if £5 is e-close to 8q in the diamond norm \\£g — £c||<> ^ e f° r some small e > 0. The 
diamond norm is directly related to the probability for Eve to distinguish £c from 8$ 
under ideal circumstances (i.e., when she can control both the inputs and the outputs), 
and therefore puts an upper bound on her ability to distinguish them in practice. 

For a simple example, the difference between two DCs applied to N qubits has norm 

N ( N \ 

\Wr-K N \l = Y.[ . (5.9) 

where p is the error-rate of the channel Eve expects and r = p + 5p is the error-rate 
of the steganographic channel that emulates Eve's expected channel. If we make bp < 
€\Jp(l — p)/N then we can make this norm as small as we like, while communicating 
0(5pN) = 0(e\fN) secret qubits. This indicates that even if Eve has exact knowledge 
of the channel, Alice and Bob can in principle send an arbitrarily large (but finite) 
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amount of information without arousing Eve's suspicion, by choosing a sufficiently small 
5p and large N. If Eve's knowledge of the channel is imperfect, Alice and Bob can do even 
better, communicating steganographic information at a nonzero rate. If Eve is constantly 
monitoring the channel over a long period of time, and if she has exact knowledge of 
the channel then she will eventually learn that Alice and Bob are communicating with 
each other steganographically. Moreover, with constant measurement Eve can disrupt 
the superpositions of the steganographic qubits and prevent any information from ever 
reaching Bob, effectively flooding the quantum channel with noise. 

If Alice and Bob have shared ebits, they can perform measurements on each of their 
halves and distill correlated random bits. Moreover, with shared ebits Alice can send 
her quantum information to Bob via quantum teleportation by sending only classical 
bits through the channel. These classical bits are the result of her measurement on her 
half of the ebits and her stego qubits. To Eve who may be monitoring the channel, 
these bits will look maximally mixed (random). For her to change the outcome of what 
Bob receives on his end, Eve would have to disrupt the bits. So if Eve is measuring the 
channel continuously, Alice and Bob can still send quantum information to each other 
using their shared ebits. 

5.2 The Diamond Norm 

In this section we gather the definition of the diamond norm and some of its rele- 
vant properties to derive the norm of the difference between N uses of two binary- 
symmetric channels (BSC) and two depolarizing channels (DC). We refer the reader to 
John Watrous's lecture notes for the definition and properties of the diamond norm [53]. 
As mentioned in the main text the diamond norm give us a measure of how "close" or 
similar two channels can be when they transform an arbitrary density matrix from one 
Hilbert space to another. More formally let N be some arbitrary super-operator, and 
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let M : L (V) — > L (W), where L (.) is a space of linear operators on the Hilbert spaces 
V and W. Then one can define the diamond- norm of M as: 



= \\l L {v)®^\\ tr , (5-10) 



where ||JV|| tr is defined as: 



tr _max{||AaO)||, r : O G L (V) , ||0|| tr = 1} • (5.11) 



The maximization in (5.11 is over all density matrices. When the Hilbert space is infinite 



dimensional we take the supremum of the set defined in Definition(5.11 ). 



Binary Symmetric Channel 

Let < p < 1/2 be the rate at which Alice flips the qubits of her codeword. Let r = p+Sp 
be the rate at which the BSC flips qubits, where 5p is some additional noise which is not 
under the control of either Alice or Bob. We assume that < p < r < 1/2 because at 
p = 1/2 the channel has zero capacity to send information and p > 1/2 means that more 
qubits are being flipped which is unnatural for this channel. For a single qubit (N = 1) 
let M p be the BSC that Alice applies to an arbitrary single-qubit density operator p: 

M pP = (l-p)p + pX P X , (5.12) 

and let J\f r be the actual BSC 

M r p= {l-r)p + rXpX . (5.13) 
We can now express the difference of the two channels as: 

{N r - N p )p =(p- r)p + (r - p)XpX (5.14) 
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We can express the diamond norm of the difference of the channels M p and M r as: 



= max ®{N r -N p ))p\\ tr (5.15) 



= (r-p)max||(I® I)p(J ® I)- (I ® X)p{I ® X)\\ tr . (5.16) 

When we substitute p = tp ® 1 0) (0 1 (tp is some arbitrary density operator) in the above 
equation we achieve the maximum. 

Il^r-^pllo = (^-P)ll^8'|0)(0|-^®|l)(l||| tr (5.17) 

< [|^®|0)(0|[| tp + |-l[||V®|l)(l|[| tP (5-18) 

= (r-p)||^|| tr |||0)(0||| tr + ||i/»||, r |||l)(l||| tr (5.19) 

= (r-p)(l + l) (5.20) 

= 2(r-p) (5.21) 

= 2(p + Sp-p) (5.22) 

= 25p. (5.23) 



In Equation (5.18) we use the triangle inequality and in Equation (5.19) we use the fact 
that for any two linear operators A and B, the trace norm of their tensor product is 
equal to the product of their trace norms, i.e., \\A (g> B\\ tr = \\A\\ tr \\B\\ tr . We would like 
an expression for the optimal probability to correctly distinguish two channels. 

Po P t = l + l\\K-K\\o ■ (5-24) 



So for a single-qubit use 



Papt = \(l + 8p) . (5.25) 



For the case where we have two qubits, we can write Alice's BSC as: 

(M p ® M p )p = (1 - pfp + p(l - p)X lP X 1 + p(l - p)X 2P X 2 + p 2 X 1 X 2P X 1 X 2 , (5.26) 
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where X\ = X ® I and X2 = I <g) X, and X1X2 = X (g) X. We can similarly calculate 
A/"i ® jVi. We can now write the difference between the two channels as: 



(M r 8) M. - N p ®N p )p= (r 2 - 2r + 2p - p 2 ) 

+ ( r _ r 2 _ p + p 2 )(XipXi + X 2 pX 2 ) 
+ (r 2 -p 2 )X 1 X 2 pX 1 X 2 . 



The diamond norm of the difference between two BSC on two qubits can be expressed 
as: 

\\M r ®M r - M p ® MpW^ = max || (I (g> (Af r <8> jV r — A/^ <8> M p ))p\\ tr . (5.27) 
We use a similar construction from the single-qubit case to maximize the right side of 



Equation (5.27). Letting p = -0 <8> |00)(00| we get: 



\\N r ®K -M p ®N p \\^ = |(1 -r) 2 - (1 -pf\ +2\r{l-r)-p{l-p)\ + |r 2 -p 21 

(5.28) 

Given our constraints that < p < r < 1/2, the first term on the right side of Equa- 



tion (5.28) is negative while the second and third terms are positive. This give us: 



\\AT r ®W r -N p ®A^|| = 2(r -p)(2 - r - p) 

= 25p{2 -2p- 25p) . 



(5.29) 
(5.30) 



So in the double-qubit case P op t is: 



Popt = -(l + 5p{2-2p-2r)) 



(5.31) 
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If we observe Equation( 5.28) carefully we find that the terms are distributed binomially. 
For the case where we have N qubits, we can use p = tp ® |00 • • • 0) (00 • • • 0| to maximize 
the diamond norm for N uses of BSC to get: 

N ( N \ 

\\K® N -Mp N \l = J2 ( \\^{l-r) N ^ -pP(l-p) N ^\ . (5-32) 
Depolarizing Channel 

The calculation of the diamond norm of the difference between N uses of two depolarizing 
channels (DC) is similar to the calculation of BSC that we performed in the previous 
section. The expression for the channel is 

N pP = (1 - p)p + (p/3 ( XpX + YpY + ZpZ) . (5.33) 

Eve sees a channel with a somewhat higher rate r = p + 5p. As in the BSC case we 
assume that < p < r < 1 /2. For N = 2 case the difference between the two depolarizing 
channels is: 

(Af r ®M r -M p ® M p )p = ((1 - r) 2 - (1 - p) 2 )p 

+ ((1 - r)(r/3) - (1 - p)(p/3))(X lP X 1 + ■■■ + Z 2 pZ 2 ) 
+ ((r/3) 2 - (p/3) 2 )(X 1 X 2 pX 1 X 2 + • • • + Z x Z 2 pZ x Z 2 ) . 
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The density matrix that maximizes the trace norm is p = ip <8> | < l )+ )($ + |, where |$ + ) 
l/V2(\00) + |11)), and ij> is some arbitrary single-qubit density operator. 

\\K ® K - AT P ® ATpll = | (1 - rf - (1 - pf | 

+ 6|(l-r)(r/3)-(l-p)(p/3)| 
+ 9|(r/3) 2 -(p/3) 2 | 



= |(1 -r) 2 - (1 -^) 2 | + 2 |(1 - r)r - (1 - + |r 2 -p 2 | . 

After evaluating the absolute value terms, we get: 

\\K®K-N P ®K\\o =2(r-p)(2-r-p) (5.34) 

= 25p(^2 - 2p-Spj . (5.35) 

So, 

P op t = \ + \spU-2p-5pj . (5.36) 

For the general case for N uses of the depolarizing channel we may write the diamond 
norm as: 

N ( n\ 

\W? N -K N \l = £ ( J H 1 - r ) N ~ 3 -w-p) N ->\ . (5-37) 

which is exactly the same expression as for the BSC. 
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Achievable Rate for Protocol 2 

We will work out the simplest example — the BSC in the case where the physical channel 
is noise-free. The errors in the codewords that Alice sends to Bob are binomially dis- 
tributed. Let pN be the mean of this distribution and let the variance be pN5, where 
< S <C 1. Here N is the length of each of codeword. Let 



be the errors that Alice applies to her codewords. For each k from Np(l — 5) to Np(l + 5) 
choose Ck strings of weight k. Let 

Np(l+S) 

c= Yl c *- ( 5 - 39 ) 

k=Np(l-S) 

Let these sets of strings be called S k , and 



So the total number of strings in the set S is C. Define the probability q = 1/C. Then 




(5.38) 



s = UkSk 



(5.40) 



we want to satisfy qCk = Ck/C = Pk- Clearly we must have Ck < (^), for all k. This 



implies that: 




N-k 



^C kP k (l-p) 

^p k (l-p) 



N-k 



<q 



<C k q 
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We want C to be as large as possible, which means we want q to be as small as possible. 
This constraint then gives us 



q = 



P 




=>C = l/q 



C = p- Jv p( 1 -*)(i - p yN(i-p+ P s) 



The number of bits that Alice can send is, therefore 



M = log 2 C 



= N(-plog 2 p- (1 -p) log 2 (l -p) + 5{p\og 2 p - p\og 2 (l -p))) 



= N{h{p)-p5\og 2 {{l-p)/p)) 



So with this encoding Alice can send almost Nh(p) bits. 
Diamond norm for protocol 2 

Again we consider the simplest case of the BSC. Let N be sufficiently large so that the 
total probability of the typical errors is > 1 — e, and these typical errors have weight k 
in the range Np(l — 5) < k < Np(l + 5). We divide up all errors of weight k into Cfc 
partitions containing 



errors each. Within each set the errors are all equally likely to be chosen. However, 
because the number of errors is unlikely to divide exactly evenly into Ck sets, the 
probabilities qk of an error of weight k will be slightly different from the probability 
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Pk = —p) N k °f the binomial distribution. We can put a (not-very-tight) bound on 
this difference: 



Qk ~Pk\ < 




k-Np(l-S) 



Pk 



- 1 



< 




p 2k (l-p) 



N-2k 



(5.41) 



Plugging this into the expression for the diamond norm, we get 





- Qk 



k=Np(l-S)+l 




Np(l-S) 



1 - 2p + 2p 
1 — p 



,2\ N 



(S37) 



which is exponentially small in N. 

Error-correction for protocol 2 with a noisy channel 

Since errors can act in a complicated manner on the space of syndromes, it is not entirely 
clear what the optimal encoding is even for a simple channel. Here we present one 
encoding for the BSC that gives an achievable rate in the limit of large N, but it is quite 
likely that higher rates are possible. 

In the noiseless case, it is possible to use the C(N,M) strings of weight M as a 
code — each string represents one possible weight-M error. If we then apply a BSC with 
probability p, on average Np bits would be flipped. If Np <C M then one can keep only 
a subset of the weight-M strings, separated by a distance > 2Np. 

This encoding quickly becomes inefficient as p gets larger. Using the shared secret 
key, Alice can instead chose only a subset of the N bits to hold the codewords. If this 
subset includes N' bits, then the errors on the remaining N — N' bits are irrelevant and 
do not need to be corrected. The limit of this would be similar to encoding 1 in the 
paper, where N' ps 2M. 
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Let N' = qN for some < q < 1 . The number of strings of weight M is C (qN, M) , 
and there will be an average number of bit flips pqN on the relevant portion of the 
codeword. Keep a subset of these codewords separated by distance 2pqN. Decoding is 
done by finding the closest codeword to the output string. 

As N, M — > oo then the number of codewords will go like 



The number of bits will be log 2 C (N, p, q) . 

Since q is a parameter we can choose freely, we choose it to maximize the rate 
H(N,M,p,q) = (l/N)\og 2 C(N,M,p,q). Using the Stirling approximation, differenti- 
ating with respect to q, and setting the result equal to 0, we can solve for q: 



We can then plug this back into the formula for 1Z. If the physical channel has error 
rate p and Alice is attempting to emulate a channel with error rate p + Sp, then M = 
NSp/(l — 2p). This gives us the following expression for the rate: 



We can compare this to the rate from encoding 1, which for the BSC is 28p(l — h(p))/ (1 — 
2p). It is not hard to see that TZ(p, Sp) above approaches this rate as p — > 1/2 (and both 
rates go to zero), but as p — > this encoding does considerably better than encoding 1. 
It is quite likely, however, that there may be even more efficient encodings. 





(qN\ ■ 

\pqNj 




n{p,5p) = - Y ^ r \o g2 (2 ft W-l) 
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5.3 Concluding Remarks 

We presented two different protocols for hiding quantum information in the codewords 
of a quantum error-correcting code. Using the first protocol, Alice can hide quantum 
information in the actual qubits of the QEC, by sharing secret information about the 
location of the chosen qubits with Bob. In the second protocol she hides quantum 
information by encoding it into the syndromes of a QEC. In both protocols, she encodes 
the information in such a way as to match the probability distribution of the depolarizing 
channel. We generalized how Alice and hide quantum information by using general 
quantum channels and a general QEC by utilizing typical sequences, it is not immediately 
clear what sort of encoding will yield an optimal rate for the transmission of quantum 
information between Alice and Bob. We also presented a rigorous security criterion and 
showed that it is always possible for Alice to send a finite amount of quantum information 
to Bob even when the noise is not completely under their control. In the next chapter 
we present an example of how Alice hides four stego-qubits in to the perfect code and 
how using a particular encoding she can transmit an optimal number of stego-qubits 
to Bob without apprising Eve. We essentially cast the problem of encoding as a linear 
optimization one. 
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Information qubit 




Figure 5.2: Quantum Steganographic Protocol. Alice hides her information qubit (solid 
brown circle) by swapping it in with a qubit of her quantum codeword. She uses her 
shared secret key with Bob to determine which qubit to swap. She uses the shared key 
again to twirl the information qubit. She further applies random depolarizing errors 
to the rest of the qubits of the codeword (shown in green). She sends the codeword 
through a depolarizing channel to Bob who uses the shared secret to correctly apply the 
untwirling operation, followed by locating and swapping out Alice's original information 
qubit. 
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Chapter 6 



Hiding Quantum Information in 
the Perfect Code 

By this it appears how necessary it is for any man that aspires to true knowledge to 
examine the definitions of former authors; and either to correct them, where they are 
negligently set down, or to make them himself. For the errors of definitions multiply 
themselves, according as the reckoning proceeds, and lead men into absurdities, which at 
last they see, but cannot avoid, without reckoning anew from the beginning; in which 
lies the foundation of their errors. For between true science and erroneous doctrines, 
ignorance is in the middle. Natural sense and imagination are not subject to absurdity. 
Nature itself cannot err: and as men abound in copiousness of language; so they become 
more wise, or more mad, than ordinary. Nor is it possible without letters for any man 
to become either excellently wise or (unless his memory be hurt by disease, or ill 
constitution of organs) excellently foolish. For words are wise men's counters; they do 
but reckon by them: but they are the money of fools, that value them by the authority of 
an Aristotle, a Cicero, or a Thomas, or any other doctor whatsoever, if but a man. 

— Thomas Hobbes 

In the previous Chapter [5] we detailed protocols to send quantum steganographic infor- 
mation from Alice to Bob. In this chapter we give specific examples of the second 
protocol that we outlined in the previous chapter. In our first example Alice and Bob 
use the [[5, 1, 3]] code, which is also called the "perfect" code. It is called perfect because 
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Figure 6.1: Encoding circuit for the perfect code. The H gate is a Hadamard gate, and 
the two-qubit gates are CNOT gates. The first four qubits are ancilla qubits and the 
fifth qubit \ip c ) is the cover-qubit. 

it was the first example of the smallest quantum error-correcting code that could cor- 
rect an arbitrary single-qubit error. It is a nondegenerate code because each error gets 
mapped to a unique syndrome. Alice and Bob use this code to hide up to four qubits of 
information which they send over a channel that to Eve looks like a depolarizing channel. 
Our second and third examples are based on the six-qubit code and the Steane code, 
respectively. We end this chapter by showing how we can go to bigger block sizes by 
combining several five-qubit blocks. By hiding a qubit of information in each block, we 
hope that the combined errors from all the smaller block on larger combined block is a 
typical error. 



6.1 Protocol 

The perfect code is a distance three code and so it can correct up to an arbitrary single- 
qubit error. It encodes one logical qubit into five physical qubits. As we mentioned 
before it is a nondegenerate code and so each single-qubit error is mapped to a unique 
syndrome. The perfect code has n — k = 5 — 1 = 4 stabilizer generators which we list 



in Table 6.1, along with the logical operators. Figure 6.1 shows the encoding unitary 



circuit for the perfect code. We obtained this circuit using the algorithm described in 



Section 3.6 For the sake of convenience and completeness we reproduce the algorithm 



below to generate the encoding unitary circuit for the perfect code. We begin by first 
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Table 6.1: Stabilizer generators gi, . . . , 54, and logical operators X and Z for the perfect 
code. The convention in the above generators is that Y = ZX. 



converting the stabilizer generators in Table 6.1 into a binary form which we refer to 
as a Z\X matrix. We obtain the the left Z submatrix by inserting a "1" wherever we 
see a Z in the stabilizer generators. We obtain the X submatrix by inserting a "1" 
wherever we see a corresponding X in the stabilizer generator. If there is a Y in the 
generator, we insert a "1" in the corresponding row and column of both the Z and X 



submatrices. The idea is to convert matrix [6TT] to matrix 6.8 through a series of row and 



column operations. The binary form of the matrix in 6.1 corresponds to the stabilizer 



generators in Table [67Tj We can use CNOT, Hadamard, Phase, and SWAP gates. 



(i) . When we apply a CNOT gate from qubit i to qubit j, it adds column % to column 

j in the X submatrix, and in the Z submatrix it adds column j to column i. 

(ii) . A Hadamard on qubit i swaps column i in the Z submatrix with column i in the 

X submatrix. 

(iii) . A Phase gate on qubit % adds column i in the X submatrix to column i in the Z 

submatrix. 

(iv) . When we apply a SWAP gate from qubit i to qubit j, we exchange column i with 

column j in Z submatrix and column i and column j in the X submatrix. 

Row operations do not change the error-correcting properties of the code. They do not 
cost us in terms of gates. 
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Swap rows one and four. 
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Apply Hadamard to qubit one and five. 
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Apply CNOT from qubit one to qubit two, four, and five. 
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10 
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Apply Hadamard on qubit one and then swap row two with row four. 



1 

110 

1 

111 





1 

10 1 

10 



(6.5) 



Apply Hadamard on qubit two and three, followed by CNOT from qubit two to qubit 
three and four. 



1 



110 

1 1 





10 

1 

10 



(6.6) 



Now apply Hadamard gate on qubit two, three, and four, followed by CNOT from qubit 
three to qubit four and five. 



1 

10 



1 







10 

1 



(6.7) 



Apply a Hadamard on qubit five, followed by a CNOT from qubit four and five, and 
then ending the operations with a Hadamard on qubit three and four. 
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10 

10 
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Figure 6.2: Steganographic protocol to hide four qubits of information using the per- 
fect code. Based on a classical shared secret key with Bob, Alice hides four qubits, 
IV'i)) • • • > I ^4) by applying the twirling procedure to each of her four qubits and trans- 
forms each qubit into a maximally mixed state. We call this system the stego subsystem 
5. The twirling procedure is applied by the yellow box. We label the first four ancilla 
qubits |0) along with the cover-qubit \ipc) as Alice's subsystem A. The first unitary 
U\ depicted by the blue box is applied to the subsystems A and S, followed by unitary 
U2- Finally Alice applies the encoding unitary £ to subsystem A and sends it over a 
channel to Bob. She traces out subsystem S. Bob upon receiving the codeword decodes 
it by applying the decoding circuit V. He uses the shared secret key to undo the unitary 
transformations IA\ and IA2 that were applied by Alice. He finally uses the shared secret 
key to untwirl the qubits to obtain the stego qubits. 



We have finally obtained a binary matrix that corresponds to the canonical stabilizer 



generators in Table 6.1 Multiplying the above operations in reverse takes us from the 
unencoded canonical stabilizers to the encoded ones. 

Next we need the syndromes corresponding to single-qubit errors. The perfect code 
has a total of fifteen single-qubit errors. Each of the five qubits can undergo a single bit- 
flip error X\ , X2 , . . . , or X5 , a single phase-flip error Z\ , Zi , ■ ■ ■ , or Z5 or a combination 
of both characterized by Y\, Y2 , . . . , or Y$. We also add the no error operator I II II 
to this list. We express X<S>I ( S>I ( S>I ( S>I succinctly as either XI II I or as X%, and 
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similarly with the other error operators. We generate the syndrome of each single-qubit 



error operator by taking the symplectic product of the parity check matrix 6.1 with the 
binary vector of the error operator corresponding to a single-qubit error. We write the 
binary vector of an error operator in the same way that we constructed the rows of the 



parity check matrix 6.1 As an example the binary vector corresponding to XIIII is 
[00000 1 10000]. Before we show how to take the symplectic product between a binary 
matrix and a vector, we must clarify the procedure between two binary vector of length 
two. 

Suppose u, v G (Z2) 2 . Let us employ the shorthand u = [z\x] and v = [z'\x'\ where 
z, x, z', x' G Z2. For example, suppose u = [0|1], and suppose v = [1 1 0] . Let denote 
the symplectic product between two elements u,v G (Z2) 2 : 

u v = zx — xz . (6-9) 



Then based on our example above, the symplectic product between u and v is: 

[O|1]0[1|O] = 0.0-1.1 
= 0-1 

= 1 (6.10) 

Let the binary matrix A and the binary vector v be of dimensions M x 2N and 2N x 1, 
respectively. So v is a column vector. Furthermore, let Aij be an element of A indexed 
by row i and column j. We divide the matrix A into the Z part and the X part which 
we label as A z and A x respectively. The Z part of A consists of columns from 1 to 
N, and its X part consists of columns from iV + 1 to 2N. So A?- is an element of A 
belonging to the Z part at row i and column j. Similarly let v z and v x be the Z and 
X part of the binary vector v. Rows of v labeled from 1 to N belong to the Z part, 
whereas rows labeled from N + 1 to 2N belong to the X part, vf refers an element of 
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Table 6.2: Syndrome table of the perfect code. The error operators are ordered according 
to syndrome values. 



v indexed by row i belonging to the Z part. Let w be the symplectic product of A and 
v. We calculate each element Wj of w as: 



W; 



M 2N 
i=l j=l 



(6.11) 



In the above equation it should be clear that in the first part of the sum the elements 
of A z are indexed by j between 1 and N, whereas the elements of v x indexed by i go 
from iV + 1 to 2N. Based on the above equation we can calculate the syndromes of 



single-qubit errors for the perfect code which we list in Table 6.2 We now detail the 
steps Alice takes to hide four stego qubits. We label Alice's subsystem as A, and the 
stego subsystem as S. The initial combined A and S subsystems after the S subsystem 
has passed through the twirling procedure is: 



P 



.SA 



<g> |0000)|V'c>" 4 (0000|(^c|" 4 - 



(6.12) 



The maximally mixed state is 1/2. If we measure this state, we will get the result '0' 
with probability 1/2 or we will get the result T' with probability 1/2. So the results of 
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the measurement are completely random. We can rewrite the S subsystem of the state 



in Equation(6.12 ) in the computational basis as: 



15 



5»<fc|. 



(6.13) 



i=0 



In Equation(6.13), we index the ket states from to 15, but we must think of their 



binary representation. So for example |0) is |0000). When we combine Equation(6.13 ) 
with the initial state described by Equation( |6.12 ), we get: 



1 15 

? A = — \k){k\ S 10000) | Vc)- 4 (00001 tyc\ 



(6.14) 



k=0 



We further simplify the state p SA by writing it as: 



1 15 



(6.15) 



fc=0 



where |0) = |0000). We define the first unitary U± shown in the blue box in Figure 6.2 



as: 



15 



(6.16) 



i=0 



The Ei are the error operators listed in Table 6.2, ordered from top to bottom. So E\ 
corresponds to the error operator IIIII. We define the second unitary U2 depicted by 



the green box in Figure 6.2 as: 



15 



u 2 = J2( xj ) s ®\i)(i\ A ® lA 



(6.17) 



j=0 



In Equation(6.17) X 3 is a shorthand notation for X n (8) X n ® X n ® X 34 , where each 



31,..., j 4 is either or 1. For example, X° = X° (8) X° ® X° (8) X° = I (8) I (8) I (8) I. The 
operator I@ acts on the cover-qubit (information qubit) \ipc)- After Alice applies the 
unitary XJ\ and U2, followed by the encoding unitary £, and the tracing out procedure, 
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she must end up with a channel model that looks plausible to Eve. In this case she is 
trying to match the depolarizing channel: 



p -> N{p) = (i - p)p + (i - p) 4 ^ J2 Xi P x * + Yi P Y * + Zi P Zi - ( 6 - 18 ) 

i=0 



We have taken each error operator E{ from Table 6.2 and listed it as a tensor product 



fj <8> Oi in the first two columns of Table 6.3 We will use this table as we derive the 



channel model. We write the state that emerges after Alice applies U\ to p SA as: 

pf A = U lP SA U\. (6.19) 

Alice then applies Uz, and the subsequent state is: 

p SA = UzfiAul (6 . 20) 

The encoding unitary that Alice applies is U e = I s ® U A : 

p S e A = U eP l A Ul (6.21) 
followed by tracing out the S subsystem: 

4 

Tr S [p S e A ] =p A ^M{ Pe ) = (l-p) Pe + (l-p) 4 ^ J^XiPeXi + YiPeYi + ZiPeZi. (6.22) 

6 i=0 

We claim that the above three unitary transformations and the partial-trace of the 
5 subsystem produces the correct depolarizing channel. We now detail the protocol. 
Alice and Bob a-priori know which quantum error-correcting code they will be using 
to send steganographic messages to each other. Alice and Bob also share a classical 



secret key which is indicated by the bold black lines in Figure 6.2. They require this 
key for two purposes. First, it allows Alice to twirl an arbitrary stego-qubit into a 
maximally mixed state. Given an arbitrary density matrix p, the twirling operator T 
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Figure 6.3: Swap circuit 

takes p — > l/4(/9 + XpX + Y pY Z pZ) = 1/2. Alice and Bob use two bits to determine 
which of the four operators I, X, Y, or Z to apply. It is important to realize that the 
twirled state looks maximally mixed to Eve who does not have access to the secret key. 
Also note that the state p that Alice produces is an average state, the result of applying 
the operators /, X, Y, or Z repeatedly. In this protocol since Alice is hiding four stego- 
qubits, she and Bob consume eight bits in the twirling procedure. Second, Alice and Bob 
use the key to select those error operators that have distinct syndromes. These are the 



operators that go into the construction of the the unitary U\ in Equation (6.16). The 



error operators Ef"®0^ are listed in Table 6.3 The intuition behind using the unitaries 



U\ and U2 is that by using them Alice can swap in her stego-qubits with the ancillas of 
the codeword. They act as generalized swap operators. We depict the usual swap circuit 



in Figure 6.3 When we swap in an arbitrary qubit with an ancilla state |0) we only 



need two CNOT gates, instead of three. Alice applies U\ to the initial state p SA to get 
the state pf- 4 : 



l - \i)(i\k)(k\j)(j\®£mm]®O t \iPc)(*Pc\0^ 

i,j,k=Q 
1 15 

g 8ikSkj\W\®£i\W\£}®Oi\4c)Wc\0}, 

i,j,k=Q 

1 15 



(6.23) 
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XXIZ 


X 
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S12 
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Z 
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X 


IIIYI 


1111 
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Table 6.3: Encoded error operators of the perfect code. 
Next Alice applies the unitary U2 to the state pf A : 



P2 



15 

- X k \i)(i\X l ®(k\£mml\m^®0^ c )(MOl (6.24) 



i,k,l=0 
15 



= l6~ E X k \i)^\X l ®(k\i)mk)(l\®0^ c )^c\0\, 

i,k,l=0 
15 

= is E ^ fc |*)<i|^ , ®^«|fc)<i|®O i |^ c )<V'c|Oj, 

j,fc,i=0 

= Y6 E x *l^l x * ® l*> <*l ® Wc> Wc|0j, 

i 

1 15 



i=0 
15 



^ E |0> <0| (Si Oi) |0)(0| (8) ® • 



(6.25) 

(6.26) 
(6.27) 

(6.28) 

(6.29) 
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As mentioned before these error operators appear in Table 6.3 In Equation (6.25) we 



see that each £j transforms |0) to the corresponding syndrome \i). Also recall that 
|0) = 1 0000). Alice finally applies the encoding unitary U e to pf" 4 : 



P S e A 



1 15 

-Y 

16 ^ 



i=0 
15 



-y 

i 15 

-Y 

16 ^ 

i=0 

1 15 

-Y 

16 ^ 

i=0 



®|V>c)(V>c|(£i®0i)W) t , 



5 8) Uf (£ t Oi) (U^Uf \0)(0\ ® IV-cX^K^ 4 )^ (£< ® 0i) f (uf)K 



Efp e (Ef)l 



Alice finally traces out the stego subsystem: 



(6.30) 



So finally: 



^[pf 1 ] = ^E<6|0)£f Pe (£f)t 



i=0 
15 



i=0 



?)t 



i=0 



(6.31) 



(6.32) 



where p e is a codeword of the perfect code. The first encoded error operator (column 



three) in Table 6.3 is IIIII. To plausibly use the five-qubit code, the error rate p must 



be sufficiently low that it is rare for more than one single-qubit error to occur. So if Eve 
intercepts this state and checks the error syndromes, the result should look reasonable 
for a codeword that has passed through the depolarizing channel. 
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6.2 Average rate of steganographic transmission 

While the encoding given in the previous section is reasonable for encoding stego-qubits 
in a single codeword, it would not do if Alice wants to send many messages to Bob. 
It would quickly look suspicious if almost every codeword had exactly one single-qubit 
error. For longer messages, Alice must most often apply no errors, from time to time 
apply a single error, and perhaps occasionally apply two errors (an uncorrectable error), 
in such a way as to match the statistics of a depolarizing channel with error probability 
p. 

In this section we present details of how Alice optimizes the number of stego-qubits 
that she sends to Bob by encoding her stego-qubits in the syndromes of the perfect 
code. She either sends no stego-qubits to Bob (and applies no errors to the codeword) or 
she sends four stego-qubits to him (applying either one or two errors). We would like to 
maximize the number of stego-qubits that Alice can send to Bob under the constraint that 
Alice's encoding scheme should match the probability distribution of the depolarizing 
channel. The channel model that we are interested in is: 

M(p) = (1 - V fp + P{1 ~ P)A Y, ( X iP X i + Y iP Y i + Z iPZi) + p2{1 ~ P)3 £ (xiXjpXiXj 

i=0 ^ ' i<j ^ 

+ XiYjpXiYj + XiZjpXiZj + YiXjpYiXj + Y^pY^ + Y.Z.p))/, + Z,X jP 

+ Z,X, ■ Z.YjpZ.Y, ■ Z.ZjpZ.Z^j. (6.33) 

There are of course three, four, and five qubit errors, but it is very unlikely that such 
errors will occur, and so we neglect them for this paper. The techniques we give here 
could easily be used to find stego-encodings for those cases as well; but it might appear 
suspicious if Alice and Bob used an encoding that frequently suffered uncorrectable 
errors. 
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We use three distinct classes of encodings. The first class corresponds to no errors, 
and transmits no hidden information. This always has the syndrome sq = 0000 in 
Table EM 

Alice's second encoding class corresponds to all single-qubit errors, plus no error, 
with equal probability. These are the syndromes sq = 0000 to sxs — 1111 in the same 
table. This is the encoding described in the previous section. So this encoding class 
includes a single encoding, and transmits four stego-qubits. 

The third encoding class corresponds to the set of all two-qubit errors. There are 
ninety such errors. These ninety two-qubit errors naturally divide into six sets of fifteen 
errors each, where each set has one error corresponding to each of the fifteen nonzero 
syndromes. By also including the "no error" operator, each set corresponds to an encod- 
ing that can transmit four stego-qubits. We list these six sets in Table |6.5| When Alice 
sends four stego-qubits to Bob, she must use all sixteen distinct syndromes. A single row 
of this table, spanning all sixteen syndromes, corresponds to a single encoding. Each 
encoding proceeds exactly as described above for the single-error case, except that the 



operators Si and Oi from Table 6.5 are used in Eq. (6.16 ) instead of those from Table 6.3 
We now need to solve for how often the three classes of encodings should be used 
to match the channel statistics. Let Qq be the fraction of times Alice uses the (trivial) 
first encoding class; Q\ the fraction of times that Alice uses the second (single-error) 
encoding class; and Q2 the fraction of times that Alice uses one of the six two-error 
encodings (which should be used equally often). The channel distribution constraints 
are as follows: 



Po = a-pf = Qo + ^(Qi + Q2), (6.34) 

lb 

PX = 5p(l-p) 4 = ~Q 1; (6.35) 
16 

15 

p 2 = Wp 2 (l-pf = —Q 2 . (6.36) 

lb 
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In the channel constraint equations above, po,pi, and p 2 represent the total probability 
of the channel applying no errors, one error, or two errors on the codewords. The 
right-hand-side of the equations represent how Alice matches the channel's probability 
distribution. For example, she always applies no errors if she uses the first (trivial) 
encoding, and with probability 1/16 if she uses one of the other encodings. We solve for 
Qo,i,2 to get: 

Qo = Po - (Pi +P2)/15, 

Q a = (16/15)pi, (6.37) 
Q 2 = (16/15)p2. 



Note that these numbers do not add up to 1 , because we have neglected errors of weight 
three or more. For small p they will come close. 

The average number of stego-qubits that Alice can send to Bob under the above 



constraints is N avg = ^(Qi + Qz) = (64/15) (pi +P2)- We plot this function in Figure 6.4 



along with the Shannon entropy of the channel (which is the maximum possible rate at 
which stego information could be sent). Note that this curve only makes sense for fairly 
small values of p; for higher values, it no longer makes sense to neglect higher-weight 



errors. 



6.3 Key Consumption 

We define the key consumption rate as the number of classical bits of key consumed by 
Alice and Bob per qubit block. Alice can send an iV-qubit block to Bob by combining 
iV/5 five-qubit blocks together. How much shared secret key do Alice and Bob require 
to send steganographic information to each other? In Section |6.2| we defined Qo as 
the probability of Alice using the first encoding to send no stego-qubits to Bob. The 
probability of using the second encoding is Qi, when Alice applies single errors to her 
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Figure 6.4: The red curve shows the Shannon entropy of the binary-symmetric channel. 
The blue curve underneath the entropy curve is the rate of steganographic information 
maximized for various values of the error-rate p of the channel. In the limit of large 
N, encoding in a single large block (rather than multiple sub-blocks) can achieve a rate 
of steganographic transmission approaching the Shannon entropy [44J. For small p one 
doesn't do too much worse using multiple finite-sized code blocks. 

codewords. Alice and Bob can also use two-error encodings to send four qubits to each 
other, of which there are a total of six as shown in Table |6.5| We assume that each of 
these six encodings are equiprobable, each with probability Q2/6. Therefore, there are a 
total of eight different encodings that Alice and Bob must choose from in order to send 
steganographic information to each other. 

For a single five-qubit block, Alice and Bob must share three classical bits to specify 
which of the eight encodings has been used. They also require an extra eight bits for 
Alice to construct her four twirled qubits and for Bob to untwirl these qubits once 
he receives the steganographic information. So Alice and Bob would consume twelve 
classical secret key bits for each five-qubit block, if they encode one block at a time, and 
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so for an ./V-qubit block they would consume at most 12 TV classical bits of key — not a 
very economical protocol. In fact, it would be less than that, since Alice needs no key 
bits to do twirling for the first, trivial, encoding. Taking this into account, the total key 
consumption rate would be (3 + 8(Qi + Q 2 ))/5 secret key bits per qubit. 

However, Alice and Bob can do much better than this by encoding into multiple 
block at once. In the limit of large N, the number of bits that they require to specify the 
key is given by the Shannon entropy of the probability distribution of the three different 
encodings. This gives us a key usage rate of 

K = 1 (-Qo log 2 Qo - Qi log 2 Qi - Q 2 log 2 Q 2 /6) (6.38) 

key bits per qubit. For small p this dramatically outperforms the rate for encoding one 
block at a time. 
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IIZYY 

-ZIZYX 
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± zj ± i y\. 
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IXXII 

ZIYII 
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YIIYI 
TYT7T 

± 1 ± Zj 1 


0010 


ZIXIZ 
IZXZX 

ZIXZY 
IIXIX 
IZXIY 
TTXTZ 

J. J. ./V 1 ZJ 


XZIII 
IYIYI 

YIIZI 
XIIIX 
IZIIY 
TTTX7, 

1 1 ± YY ZJ 


0011 


zzxxz 

-ZIYYX 

-UYYY 
IZXXX 
IIXXY 
IIXXZ 


YYIII 
ZIXII 

IXYII 
IZIIX 
XIIIY 
IIZIZ 


0100 


ZXIIZ 
IXZZY 

IXIZX 
ZXIIY 
IXIZZ 
IXZZX 


ZIZII 
IIYXI 

XIIZI 
YIIIX 
IIIYY 
IIXIZ 


0101 


IYIXI 
ZXIXZ 

IYIYX 
IXIYI 
-ZXIXX 
IXIXZ 


XYIII 
ZIIXI 

IZIZI 
IIIYX 
YIIIY 
IXIIZ 


0110 


IXXII 
IXYZY 

-IYXZX 
IXXZI 
IYXIY 

-IXYZX 


IXZII 
IIXXI 

IZIYI 
IIIZX 
IYIIY 
IIYIZ 


0111 


-ZYXXZ 
IXXXI 

IXXYX 
IYXXX 
-IXXYZ 
ZXXXI 


YZIII 
IXIXI 

XIIYI 
IYIIX 
IIIZY 
ZIIIZ 


1000 


XZZZY 
XIZIZ 

XIIZX 
XIIIX 
XIIIY 
XZIIZ 


IYXII 
IIYYI 

IXIZI 
IIZIX 
IIIXY 
IZIIZ 



Table 6.4: Table of double-qubit errors. The error operators in bold represent a single 
encoding. The table represents a total of six different encodings where each encod- 
ing utilizes sixteen distinct error operators and their corresponding distinct syndromes 
(continued). 
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Syndrome i 




Encoded Error 


Syndrome i 




Encoded Error 


1001 


-YIZYX 
-YIIYY 

XIZXZ 
XIIXX 
XIIXY 
XIIXZ 


YIYII 
ZIIYI 

IIXZI 
IIIXX 
IIZIY 
XIIIZ 


1010 


YIXIZ 
-XZYZY 

XIXII 
XZXII 
XIYIZ 
-YIXZY 


YXIII 
IYYII 

XIZII 
IZIXI 
IIXYI 
ZIIZI 


1011 


-YZXXZ 
-YIYYX 

XZXXI 
XIXXI 
XIXYX 
-XIYXZ 


ZYIII 
YIXII 

IZZII 
XIIXI 
IXIYI 
IIYZI 


1100 


XXIII 
-XYZZY 

YXIIZ 
-YXIIY 
XXZZI 
XYIIZ 


XXIII 
IZXII 

YIZII 
ZIIIX 
IIYIY 
IYIIZ 


1101 


XXZYY 
YXIXZ 

XXIYX 
XXZYZ 
YXIXX 
XXIYY 


XIXII 
YIIXI 

IIZYI 
IIYIX 
ZIIIY 
IIIZZ 


1110 


XYYZY 
XYXII 

xxxzx 

XXXIX 
XXYZI 
-XXXZY 


IZYII 
IYIXI 

IIZZI 
IXIIX 
IIXIY 
IIIYZ 


1111 


YYXXZ 
-XXYYY 

XYXXI 
XXYYZ 
XXXXY 
YXXXI 


ZZIII 
XIYII 

IYZII 
IIXIX 
IXIIY 
YIIIZ 


0000 


iiiii 
mil 

iiiii 
iiiii 
iiiii 
iiiii 


IIIII 
IIIII 

IIIII 
IIIII 
IIIII 
IIIII 



Table 6.5: Table of double-qubit errors. The error operators in bold represent a single 
encoding. The table represents a total of six different encodings where each encoding 
utilizes sixteen distinct error operators and their corresponding distinct syndromes. 
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Chapter 7 



Conclusion and Future Directions 

When I examine myself and my methods of thought, I come to the conclusion that the 
gift of fantasy has meant more to me than any talent for abstract, positive thinking. 

— Albert Einstein 

In this thesis we have made two contributions to quantum information science. We 
augmented the theory of quantum error-correcting codes by bridging the gap between 
the perfect code and the Steane code. We provided a new proof technique on how to 
show that the Steane code is the smallest CSS code that can correct an arbitrary single- 
qubit error. We also showed how to convert the six-qubit code into a subsystem code. 
We hope that in the future this code will serve as a good test-bed to protect quantum 
computers from the debilitating effects of decoherence. 

Our second major contribution to QIS is the development of the theory of quantum 
steganography. We introduced a broad theory of quantum steganography but in the 
future we would like to explore the kinds of quantum error-correcting codes and encodings 
that will give good rates for steganographic communication between Alice and Bob under 
different noise models such as, depolarizing noise, dephasing noise, and general noise 
operators. In the current model we assume that the eavesdropper (Eve) is limited to 
only observing the channel and performing non-demolition measurements of the quantum 
codewords. 

While the above is a useful starting point, one can think about other equally impor- 
tant and valid scenarios. It may be reasonable to consider a couple of models of Eve: the 
maximally powerful, limited by physics and information theory, and the more realistic, 
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limited by computational power and finite information. We can set up the problem as 
containing only three parties, Alice, Bob, and Eve. But in a realistic situation, Eve 
may simultaneously be monitoring communications between a large number of parties 
- for instance, an entire network. In this situation, Eve may have no reason to be 
suspicious of Alice and Bob more than anyone else. The desire to keep this network 
running efficiently may lead to some limitations on what Eve will and/or can do. Eve 
must allow communication, or she could just shut the channel down. If she intercepts 
and demands authentication for every communication, this makes quantum communica- 
tion impossible. Therefore, she can only intercept and demand authentication for some 
fraction of the messages, chosen at random. Without blocking the message, though, she 
could still check the error syndromes. She could do this every time, or some fraction of 
the time, which could be the same fraction with which she demands authentication, or 
a different fraction. She could just check the syndromes, or she could actually perform 
error-correction. There may be other set-ups as well in which there might not be an Eve 
per se. Suppose that there are two "innocent" communicators, April and Bill, and two 
"secret" communicators, Alice and Bob. Alice and Bob want to piggyback secret com- 
munication on top of April and Bills messages. So after April sends her codeword, Alice 
intercepts it, adds in secret information in a way that will look like noise and sends it on. 
Bob could get it either before Bill does (in which case he might extract the information 
and try to erase all evidence that it was there) , or afterwards (in which case he might get 
it after Bill has performed error-correction and discarded the ancillas). Another scenario 
is when Eve is not necessarily an adversary, but a "helpful" network. For instance, there 
may be quantum repeater stations that correct and forward the quantum information. 
If Alice and Bob know how the quantum repeaters work, might they be able to sneak 
through some extra information that was not removed in the correction? What is the 
capacity of quantum steganographic protocols between three parties, Alice, Bob, and 
Charlie? We do not know the answer to these questions and we believe that they are 
worth exploring. 
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We would also like to explore where quantum steganography fits in with quantum 
Shannon theory. Could a combination of some primitive quantum information-theoretic 
protocols in quantum Shannon theory when combined with steganography give rise to 
novel and interesting new insights? Can one treat quantum steganography as a new 
quantum information science primitive? Quantum steganography is rich in open prob- 
lems, and there is clearly a need to develop this theory further because once we do have 
commercially available quantum networks, there will be a need for private communi- 
cation. We hope that in time this theory will become a subfield of quantum Shannon 
theory. We also hope that in the near future experimentalists will be able to test our 
protocols in the laboratory. 
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